Automatically adjusting backup set rules based on anomalous backup activity

1. A computer implemented method for managing anomalous backup activity in a backup system comprising a centralized computer and a plurality of endpoint computers, the method comprising:

receiving backup metrics, by the centralized computer from multiple endpoint computers;

establishing, by the centralized computer, at least one backup baseline based on the backup metrics received from at least one endpoint computer over a given period of time, an established backup baseline specifying an empirically determined baseline level of backup activity according to specific criteria included in the backup metrics, the established backup baseline specifying at least one parameter from a group of parameters consisting of numbers of files, sizes of files, types of files, distributions across directories or across folders, and file groupings expected in a future backup;

detecting, by the centralized computer, changes in backup behavior against the at least one established baseline, based on analyzing received backup metrics;

analyzing, by the centralized computer, detected backup behavior changes that meet at least one corresponding specific threshold;

determining whether to modify backup activity based on a source from which new files included in at least one detected backup behavior change originated; and

responsive to determining to modify the backup activity, modifying, by the centralized computer, the backup activity on at least one endpoint computer by omitting files from at least one specific folder or directory from a current or future backup.

2. The method of claim 1 wherein receiving the backup metrics from a specific one of the endpoint computers of the plurality further comprises:

receiving metrics concerning a corresponding user's backup activity gathered over time by the specific one of the endpoint computers.

3. The method of claim 1 wherein receiving the backup metrics further comprises:

periodically receiving updated backup metrics, by the centralized computer from multiple endpoint computers; and

maintaining, by the centralized computer, current information concerning backup activity on the multiple endpoint computers.

4. The method of claim 1 wherein the backup metrics further comprise:

information concerning the backup activity and/or backup settings on the at least one endpoint computer.

5. The method of claim 1 wherein the backup metrics further comprise:

information concerning hardware configuration and/or software configuration of the at least one endpoint computer that is relevant to establishing backup baselines and detecting deviations from established backup baselines.

6. The method of claim 1 wherein the backup metrics further comprise:

identifiers of originating endpoints.

7. The method of claim 1 wherein the backup metrics further comprise:

identifiers of corresponding backup configurations.

8. The method of claim 1 wherein establishing the at least one backup baseline further comprises:

establishing the at least one backup baseline at a level from a group consisting of:

specific endpoint computer, specific user, specific default backup configuration,

specific organization and specific operating system.

9. The method of claim 1 wherein establishing the at least one backup baseline further comprises:

updating at least one existing backup baseline, or creating at least one new backup baseline, based on newly received backup metrics.

10. The method of claim 1 wherein detecting the changes in backup behavior further comprises:

applying at least one non-supervised machine learning techniques to received backup metrics.

11. The method of claim 10 further comprising:

applying a clustering algorithm to received backup metrics.

12. The method of claim 10 further comprising:

applying an anomaly detection algorithm to received backup metrics.

13. The method of claim 1 wherein detecting the changes in backup behavior further comprises:

detecting the changes in backup behavior at a level from a group consisting of: specific endpoint computer, specific user, specific default backup configuration, specific organization and specific operating system.

14. The method of claim 1 wherein analyzing the detected backup behavior changes that meet the at least one corresponding specific threshold further comprises:

analyzing the detected backup behavior changes that meet the at least one corresponding specific threshold to determine whether to alter corresponding backup activity in response.

15. The method of claim 1 wherein analyzing the detected backup behavior changes that meet the at least one corresponding specific threshold further comprises:

flagging changes in backup activity that deviate from at least one corresponding baseline by at least one specific threshold level; and

analyzing the flagged changes further, to determine whether to modify the at least one corresponding backup in response.

16. The method of claim 1 wherein at least one file omitted from the current or future backup comprises a file that is a result of an operating system upgrade or developer error.

17. The method of claim 1 wherein modifying the backup activity further comprises:

changing at least one default backup configuration in use by the backup system.

18. The method of claim 17 wherein changing the at least one default backup configuration in use by the backup system further comprises:

transmitting, by the centralized computer to the at least one endpoint computer, a new or modified default backup configuration.

19. At least one non-transitory computer readable-storage medium for managing anomalous backup activity in a backup system comprising a centralized computer and a plurality of endpoint computers, the at least one non-transitory computer readable-storage medium storing computer executable instructions that, when loaded into computer memory and executed by at least one processor of a computing device, cause the computing device to perform the following steps:

receiving backup metrics, by the centralized computer from multiple endpoint computers;

establishing, by the centralized computer, at least one backup baseline based on the backup metrics received from at least one endpoint computer over a given period of time, an established backup baseline specifying an empirically determined baseline level of backup activity according to specific criteria included in the backup metrics, the established backup baseline specifying at least one parameter from a group of parameters consisting of numbers of files, sizes of files, types of files, distributions across directories or across folders, and file groupings expected in a future backup;

detecting, by the centralized computer, changes in backup behavior against the at least one established baseline, based on analyzing received backup metrics;

analyzing, by the centralized computer, detected backup behavior changes that meet at least one corresponding specific threshold;

determining whether to modify backup activity based on a source from which new files included in at least one detected backup behavior change originated; and

responsive to determining to modify the backup activity, modifying, by the centralized computer, the backup activity on at least one endpoint computer by omitting files from at least one specific folder or directory from a current or future backup.

20. A computer system for managing anomalous backup activity in a backup system, the computer system comprising:

at least one processor;

system memory;

a receiving module residing in the system memory, the receiving module being programmed to receive backup metrics from multiple endpoint computers;

a baseline establishing module residing in the system memory, the baseline establishing module being programmed to establish at least one backup baseline based on the backup metrics received from at least one endpoint computer over a given period of time, an established backup baseline specifying an empirically determined baseline level of backup activity according to specific criteria included in the backup metrics, the established backup baseline specifying at least one parameter from a group of parameters consisting of numbers of files, sizes of files, types of files, distributions across directories or across folders, and file groupings expected in a future backup;

a behavior change detecting module residing in the system memory, the behavior change detecting module being programmed to detect changes in backup behavior against the at least one established baseline, based on analyzing received backup metrics; and

a behavior change analyzing module residing in the system memory, the behavior change analyzing module being programmed to analyze detected backup behavior changes that meet at least one corresponding specific threshold, to determine whether to modify backup activity based on a source from which new files included in at least one detected backup behavior change originated, and, responsive to determining to modify the backup activity, to modify backup activity on at least one endpoint computer by omitting files from at least one specific folder or directory from a current or future backup.