Malware detection and data protection integration

1. A method, comprising:

monitoring a computer system via malware detection modules deployed throughout input/output layers of the computer system, wherein each malware detection module is configured to detect activity associated with malware present in the computer system, wherein the malware modules each comprise program code respectively executing on a set of processing devices, and each processing device comprises a processor and memory, and wherein the set of processing devices are operatively coupled via a communication network to form the computer system;

upon detection of malware activity in one or more input/output layers of the computer system, one or more of the malware detection modules generating and sending respective messages reporting the detected activity to a central malware alert engine;

receiving, at the central malware alert engine, the one or more messages from the one or more malware detection modules; and

in response to the one or more received messages, the central malware alert engine alerting one or more portions of a data protection system of the computer system to enable the data protection system to take one or more remedial actions to protect the computer system from the malware present in the computer system;

wherein each malware detection module executes a set of directives to log information to assist the data protection system to determine the one or more remedial actions to take in response to the malware, and wherein the logged information comprises an identification of the input/output layer in which the malware detection module providing the message is deployed, and further wherein one or more malware detection modules at least one of recommend and initiate one or more remedial actions to take in response to the malware.

2. The method of claim 1 , wherein one or more of the malware detection modules are deployed in the data protection system and configured to detect malware activity in the data protection system.

3. The method of claim 1 , wherein the data protection system comprises one or more data backup and data recovery mechanisms of the computer system.

4. The method of claim 1 , wherein each malware detection module comprises program code configured to detect a given activity of the malware present in the computer system.

5. The method of claim 1 , wherein each malware detection module comprises program code configured to communicate with the central malware alert engine to send messages reporting a given detected activity of the malware.

6. The method of claim 1 , wherein the logged information comprises an identification of an application program executing at the input/output layer in which the malware detection module providing the message is deployed.

7. The method of claim 1 , wherein each malware detection module comprises program code configured to determine whether or not to generate or send a message to the central malware alert engine based on awareness of one or more policies relating to the malware activity in comparison to permitted activity in the computer system.

8. The method of claim 1 , further comprising the central malware alert engine sending an update to one or more of the malware detection modules, wherein the update modifies detection functionalities in the one or more malware detection modules.

9. The method of claim 1 , wherein the input/output layers of the computer system comprise a host driver layer, a network driver layer, and a storage system layer.

10. The method of claim 1 , wherein each malware detection module is configured to support one or more data access protocols.

11. The method of claim 1 , wherein the malware comprises ransomware and the detected activity comprises ransomware data encryption activity.

12. The method of claim 11 , wherein at least one malware detection module is configured to analyze read and write traffic to detect the ransomware data encryption activity.

13. The method of claim 12 , wherein the malware detection module analyzes read and write traffic by inspecting read and write traffic patterns and comparing the inspected patterns to known encryption patterns.

14. The method of claim 11 , wherein the computer system comprises a client side and a server side, and malware detection modules are deployed to detect the ransomware data encryption activity in one or more input/output layers on the client side and one or more input/output layers on the server side.

15. The method of claim 1 , wherein the computer system comprises a data center.

16. A system, comprising:

a set of processing devices, wherein each processing device comprises a processor and memory, and wherein the set of processing devices are operatively coupled via a communication network to form a computer system;

a set of malware detection modules deployed throughout input/output layers of the computer system, wherein the set of malware modules each comprise program code respectively executing on the set of processing devices; and

a central malware alert engine operatively coupled to the set of malware detection modules through an interface;

wherein each malware detection module detects activity associated with malware present in the computer system and, upon detection of malware activity in one or more input/output layers of the computer system, one or more of the malware detection modules generate and send respective messages reporting the detected activity to the central malware alert engine;

further wherein the central malware alert engine receives the one or more messages from the one or more malware detection modules and, in response to the one or more received messages, the central malware alert engine alerts one or more portions of a data protection system of the computer system to enable the data protection system to take one or more remedial actions to protect the computer system from the malware present in the computer system;

further wherein each malware detection module executes a set of directives to log information to assist the data protection system to determine the one or more remedial actions to take in response to the malware, and wherein the logged information comprises an identification of the input/output layer in which the malware detection module providing the message is deployed, and further wherein one or more malware detection modules at least one of recommend and initiate one or more remedial actions to take in response to the malware.

17. An apparatus, comprising:

a memory configured to store one or more instructions; and

a processor device operatively coupled to the memory and configured to obtain the one or more instructions from the memory to execute a given malware detection module, wherein the given malware detection module is part of a set of malware detection modules deployed throughout input/output layers of a computer system, wherein the processor and the memory are part of a set of processing devices respectively executing the set of malware detection modules, and wherein the set of processing devices are operatively coupled via a communication network to form the computer system, and wherein the given malware detection module is configured to:

detect activity associated with malware present in the computer system; and

upon detection of malware activity in the layer in which the given malware detection module is deployed, the given malware detection module generates and sends at least one message reporting the detected activity to a central malware alert engine which, receives the message and in response to the received message, the central malware alert engine is configured to alert one or more portions of a data protection system of the computer system to enable the data protection system to take one or more remedial actions to protect the computer system from the malware present in the computer system;

wherein the given malware detection module executes a set of directives to log information to assist the data protection system to determine the one or more remedial actions to take in response to the malware, and wherein the logged information comprises an identification of the input/output layer in which the malware detection module providing the message is deployed, and further wherein the given malware detection module at least one of recommends and initiates one or more remedial actions to take in response to the malware.

18. The system of claim 17 , wherein the malware comprises ransomware and the detected activity comprises ransomware data encryption activity.

19. The system of claim 18 , wherein the given malware detection module is configured to analyze read and write traffic to detect the ransomware data encryption activity.

20. The system of claim 19 , wherein the given malware detection module analyzes read and write traffic by inspecting read and write traffic patterns and comparing the inspected patterns to known encryption patterns.