Remedial actions for a storage system based on similar block detection process anomalies

1 . A method comprising:

determining, by a data protection system, that a metric associated with a similar block detection process performed by a storage system with respect to data processed by the storage system changes by more than a first threshold amount;

directing, by the data protection system, the storage system to generate recovery datasets over time in accordance with a data protection parameter set, the recovery datasets usable to restore data maintained by the storage system to a state corresponding to a selectable point in time, the data protection parameter set specifying a retention duration for the recovery datasets, the retention duration defining a duration that each recovery dataset is saved before being deleted;

performing, by the data protection system based on the determining that the metric changes by more than the first threshold amount, a first remedial action with respect to the storage system, the performing the first remedial action comprising converting a recovery dataset included in the recovery datasets into a first type of recovery dataset that has a first level of protection;

determining, by the data protection system subsequent to the converting, that the metric changes by more than a second threshold amount; and

performing, by the data protection system based on the determining that the metric changes by more than the second threshold amount, a second remedial action with respect to the storage system, the performing the second remedial action comprising converting the recovery dataset into a second type of recovery dataset that has a second level of protection greater than the first level of protection.

2 . The method of claim 1 , wherein the determining that the metric changes by more than the first threshold amount comprises:

determining a first value for the metric, the first value associated with a first time period having a particular characteristic;

determining a second value for the metric, the second value associated with a second time period having the particular characteristic; and

determining that a difference between the first value and the second value is greater than the first threshold amount.

3 . The method of claim 2 , wherein the particular characteristic is representative of at least one of a particular day of the week, a particular time period during a day, or a time duration.

4 . The method of claim 1 , further comprising setting, by the data protection system, the first threshold amount based on one or more attributes associated with the data.

5 . The method of claim 1 , wherein the performing the first remedial action comprises directing the storage system to generate a recovery dataset for data stored by the storage system.

6 . The method of claim 1 , wherein the performing the first remedial action further comprises directing, based on the determining that the metric changes by more than the first threshold amount, the storage system to use one or more of the recovery datasets to restore the data maintained by the storage system to a state that corresponds to a point in time that precedes a point in time at which the data protection system determines that the metric changes by more than the first threshold amount.

7 . The method of claim 1 , wherein the performing the first remedial action further comprises providing a notification that the storage system is possibly being targeted by a security threat.

8 . The method of claim 1 , wherein the determining that the metric changes by more than the first threshold amount comprises determining that the metric differs by more than a threshold amount from a baseline metric associated with a different dataset.

9 . A system comprising:

a memory storing instructions; and

one or more processors communicatively coupled to the memory and configured to execute the instructions to perform a process comprising:

determining that a metric associated with a similar block detection process performed by a storage system with respect to data processed by the storage system changes by more than a first threshold amount;

directing the storage system to generate recovery datasets over time in accordance with a data protection parameter set, the recovery datasets usable to restore data maintained by the storage system to a state corresponding to a selectable point in time, the data protection parameter set specifying a retention duration for the recovery datasets, the retention duration defining a duration that each recovery dataset is saved before being deleted; and

performing, based on the determining that the metric changes by more than the first threshold amount, a first remedial action with respect to the storage system, the performing the first remedial action comprising converting a recovery dataset included in the recovery datasets into a first type of recovery dataset that has a first level of protection;

determining, subsequent to the converting, that the metric changes by more than a second threshold amount; and

performing, based on the determining that the metric changes by more than the second threshold amount, a second remedial action with respect to the storage system, the performing the second remedial action comprising converting the recovery dataset into a second type of recovery dataset that has a second level of protection greater than the first level of protection.

10 . The system of claim 9 , wherein the determining that the metric changes by more than the first threshold amount comprises:

determining a first value for the metric, the first value associated with a first time period having a particular characteristic;

determining a second value for the metric, the second value associated with a second time period having the particular characteristic; and

determining that a difference between the first value and the second value is greater than the first threshold amount.

11 . The system of claim 10 , wherein the particular characteristic is representative of at least one of a particular day of the week, a particular time period during a day, or a time duration.

12 . The system of claim 9 , wherein the process further comprises setting the first threshold amount based on one or more attributes associated with the data.

13 . The system of claim 9 , wherein the performing the first remedial action comprises directing the storage system to generate a recovery dataset for data stored by the storage system.

14 . The system of claim 9 , wherein the performing the first remedial action further comprises directing, based on the determining that the metric changes by more than the first threshold amount, the storage system to use one or more of the recovery datasets to restore the data maintained by the storage system to a state that corresponds to a point in time that precedes a point in time at which the data protection system determines that the metric changes by more than the first threshold amount.

15 . The system of claim 9 , wherein the performing the first remedial action further comprises providing a notification that the storage system is possibly being targeted by a security threat.

16 . The system of claim 9 , wherein the determining that the metric changes by more than the first threshold amount comprises determining that the metric differs by more than a threshold amount from a baseline metric associated with a different dataset.

17 . A non-transitory computer-readable medium storing instructions that, when executed, direct a processor of a computing device to perform a process comprising:

determining that a metric associated with a similar block detection process performed by a storage system with respect to data processed by the storage system changes by more than a first threshold amount;

directing the storage system to generate recovery datasets over time in accordance with a data protection parameter set, the recovery datasets usable to restore data maintained by the storage system to a state corresponding to a selectable point in time, the data protection parameter set specifying a retention duration for the recovery datasets, the retention duration defining a duration that each recovery dataset is saved before being deleted; and

performing, based on the determining that the metric changes by more than the first threshold amount, a first remedial action with respect to the storage system, the performing the first remedial action comprising converting a recovery dataset included in the recovery datasets into a first type of recovery dataset that has a first level of protection;

determining, subsequent to the converting, that the metric changes by more than a second threshold amount; and

performing, based on the determining that the metric changes by more than the second threshold amount, a second remedial action with respect to the storage system, the performing the second remedial action comprising converting the recovery dataset into a second type of recovery dataset that has a second level of protection greater than the first level of protection.

18 . The non-transitory computer-readable medium of claim 17 , wherein the determining that the metric changes by more than the first threshold amount comprises:

determining a first value for the metric, the first value associated with a first time period having a particular characteristic;

determining a second value for the metric, the second value associated with a second time period having the particular characteristic; and

determining that a difference between the first value and the second value is greater than the first threshold amount.