Using recognized backup images for recovery after a ransomware attack

1. A computer implemented method comprising:

analyzing, by a computing device, content of each specific one of a plurality of image files in a set of files on an endpoint;

for each specific image file of the plurality of image files in the file set, categorizing, by the computing device, the specific image file, based on results of analyzing its content;

storing, by the computing device, categorization metadata concerning each specific one of the plurality of image files in the file set, wherein categorization metadata concerning a specific image file describes its categorization based on results of analyzing its content;

subsequently reanalyzing and recategorizing image files;

comparing reanalyzed categorization metadata to corresponding stored categorization metadata;

quantifying a degree of detected change by weighting different types of modification and/or degrees of change; and

in response to the degree exceeding a specific threshold level, adjudicating, by the computing device, that a file corruption event has occurred on the endpoint; and

taking a security action, by the computing device, in response to adjudicating that the file corruption event has occurred on the endpoint.

2. The method of claim 1 further comprising:

analyzing, by the computing device, the content of each specific one of the plurality of image files in the file set of the endpoint, during a first backup of the endpoint;

categorizing, by the computing device, each specific one of the plurality of image files in the file set, during the first backup of the endpoint; and

subsequently detecting, by the computing device, modifications made to specific ones of the image files of the plurality of image files in the file set, during a subsequent backup of the endpoint;

wherein the file set of the endpoint comprises a backup set.

3. The method of claim 1 further wherein:

analyzing content of an image file further comprises identifying at least one object graphically represented therein; and

categorizing an image file is further based on the at least one identified graphically represented object.

4. The method of claim 1 further wherein:

analyzing content of an image file further comprises identifying multiple graphically represented objects therein; and

categorizing an image file is further based on a combination of identified graphically represented objects.

5. The method of claim 1 wherein:

analyzing content of an image file further comprises identifying at least one graphical representation of a person.

6. The method of claim 5 wherein identifying at least one graphical representation of a person further comprises:

utilizing, by the computing device, automatic computerized facial recognition to identify a specific person depicted by an identified graphical representation in an image file.

7. The method of claim 1 wherein:

analyzing content of an image file further comprises identifying at least one graphical representation of a specific place or of a type of place.

8. The method of claim 1 wherein:

analyzing content of an image file further comprises identifying at least one graphical representation of a specific event or of a type of event.

9. The method of claim 1 wherein:

analyzing content of an image file further comprises identifying at least one graphical representation of a specific animal or of a type of animal.

10. The method of claim 1 wherein:

analyzing content of an image file further comprises identifying at least one graphical representation of a specific inanimate object or of a type of inanimate object.

11. The method of claim 1 wherein:

analyzing content of an image file further comprises identifying a graphical representation of text.

12. The method of claim 1 wherein:

categorizing an image file is further based on at least one factor from a group of factors consisting of: a location of image file creation, an identifier of a device on which an image file was created and a source of an image file external to the endpoint.

13. The method of claim 1 further comprising:

reanalyzing, by the computing device, content of each specific one of the plurality of image files in the file set; and

for each specific image file of the plurality of image files in the file set, recategorizing, by the computing device, the specific image file, based on results of reanalyzing its content; and

detecting, by the computing device, modifications made to specific ones of the image files of the plurality of image files in response to comparing results of the recategorizing to the maintained categorization metadata.

14. The method of claim 1 wherein quantifying a degree of detected change by weighting different types of modification and/or degrees of change further comprises:

quantifying, by the computing device, a degree of the detected modifications made to specific ones of the image files of the plurality of image files, by weighting different types of modifications and/or degrees of change, according to individual modified image files.

15. The method of claim 1 wherein quantifying a degree of detected change by weighting different types of modification and/or degrees of change further comprises:

quantifying, by the computing device, a degree of the detected modifications made to specific ones of the image files of the plurality of image files, by weighting different types of modifications and/or degrees of change, according to all modified image files.

16. The method of claim 1 wherein adjudicating, by the computing device, that a file corruption event has occurred on the endpoint further comprises:

adjudicating, by the computing device, that a cryptographic ransomware attack has occurred.

17. The method of claim 1 wherein taking a security action, by the computing device, in response to adjudicating that the file corruption event has occurred on the endpoint further comprises:

taking, by the computing device, at least one security action from a group of security actions consisting of: pausing a current backup of the endpoint, terminating a current backup of the endpoint, notifying a user of the adjudication of the occurrence of the file corruption event, directing a user to start a file recovery from a previous version, and transmitting a notification of the adjudication of the occurrence of the file corruption event to an external security server.

18. The method of claim 1 wherein taking a security action, by the computing device, in response to adjudicating that the file corruption event has occurred on the endpoint further comprises:

using categorization metadata to identify when the endpoint was compromised by the file corruption event; and

automatically recovering all files of the file set, using a most recent backed-up version from prior to the file corruption event.

19. At least one non-transitory computer readable-storage medium storing computer executable instructions that, when loaded into computer memory and executed by at least one processor of a computing device, cause the computing device to execute the following steps:

analyzing, by a computing device, content of each specific one of a plurality of image files in a set of files on an endpoint;

for each specific image file of the plurality of image files in the file set, categorizing, by the computing device, the specific image file, based on results of analyzing its content;

storing, by the computing device, categorization metadata concerning each specific one of the plurality of image files in the file set, wherein categorization metadata concerning a specific image file describes its categorization based on results of analyzing its content;

subsequently reanalyzing and recategorizing image files;

comparing reanalyzed categorization metadata to corresponding stored categorization metadata;

quantifying a degree of detected change by weighting different types of modification and/or degrees of change; and

in response to the degree exceeding a specific threshold level, adjudicating, by the computing device, that a file corruption event has occurred on the endpoint; and

taking a security action, by the computing device, in response to adjudicating that the file corruption event has occurred on the endpoint.

20. A computer system comprising:

system memory;

an image analyzing module residing in the system memory, the image analyzing module being programmed to analyze content of each specific one of a plurality of image files in a set of files on an endpoint;

an image categorizing module residing in the system memory, the image categorizing module being programmed to, for each specific image file of the plurality of image files in the file set, categorize the specific image file, based on results of analyzing its content;

a categorization metadata maintaining module residing in the system memory, the categorization metadata maintaining module being programmed to store categorization metadata concerning each specific one of the plurality of image files in the file set, wherein categorization metadata concerning a specific image file describes its categorization based on results of analyzing its content;

an image modification detecting module residing in the system memory, the image modification detecting module being programmed to subsequently reanalyze and recategorize image files, to compare reanalyzed categorization metadata to corresponding stored categorization metadata, and to quantify a degree of detected change by weighting different types of modification and/or degrees of change;

an adjudicating module residing in the system memory, the adjudicating module being programmed to adjudicate that a file corruption event has occurred on the endpoint, in response to the degree exceeding a specific threshold level;

a security action executing module residing in the system memory, the security action executing module being programmed to take a security action, in response to adjudicating that the file corruption event has occurred on the endpoint; and

at least one processor configured to execute the modules.