Automation and optimization of data recovery after a ransomware attack
View Patent ↗In the face of ransomware attacks, which can be increasingly difficult to effectively prevent, a solution can be considered to be the minimization of the cost and time taken to recover data and, hence business activities. Embodiments perform a restore operation that include automatically identifying the most recent healthy backup, from which data should be restored, and the prioritizing of the order in which data should be restored.
1. A method for performing a restore operation, the method comprising:
identifying a healthy backup from a plurality of candidate backups from which to restore production data in a computing system that has experienced an event;
classifying the production data included in the healthy backup such that the production data is ordered with a priority, wherein the priority is based on a plurality of factors;
performing the restore operation by restoring the production data from the identified healthy backup in accordance with the priority.
2. The method of claim 1 , further comprising classifying the production data based on data that is most commonly accessed, wherein the most commonly accessed data has a higher priority than data that is less commonly accessed.
3. The method of claim 1 , further comprising classifying the production data based on data that is most recently accessed, wherein the most recently accessed data has a higher priority than data that is less recently accessed.
4. The method of claim 1 , further comprising classifying the production data based on file size.
5. The method of claim 1 further comprising classifying the production data based on time of year or business activities.
6. The method of claim 1 , wherein the plurality of factors include most commonly accessed, most recently accessed, file size, time, date and business activities.
7. The method of claim 1 , further comprising, classifying the data based on at least one prioritization policy, the at least one prioritization policy including a static recovery plan, a dynamic recovery plan, and predictive analysis.
8. The method of claim 7 , wherein the predictive analysis results in data that is expected to be used in a time period receiving a priority higher than data that is not expected to be used within the time period.
9. The method of claim 8 , wherein the static recovery plan includes a preliminary prioritization, wherein the preliminary prioritization is adapted based on the factors.
10. The method of claim 8 , wherein the dynamic recovery plan adapts the factors or the static recovery plan.
11. A method for performing a restore operation, the method comprising:
determining that an event has occurred in a computing system that includes production data, wherein a plurality of candidate backups are available to the computing system such that the production data can be restored;
identifying a healthy backup from the plurality of candidate backups by:
prioritizing the production data included in the healthy backup such that the production data is restored in an order of priority, wherein the priority of a plurality of data objects included in the production data is based on a plurality of restore factors and at least one prioritization policy; and
restoring the production data from the selected healthy backup.
12. The method of claim 11 , wherein the plurality of factors include most commonly accessed, most recently accessed, file size, time, date and business activities.
13. The method of claim 12 , wherein each data object in the healthy backup is assigned a score based on the plurality of factors, each factor contributing to the score, wherein the data objects having the highest score have the highest priority and are restored first.
14. The method of claim 13 , further comprising assigning a score for each factor to each of the data objects.
15. The method of claim 11 , further comprising, wherein the at least one prioritization policy includes a static recovery plan, a dynamic recovery plan, and predictive analysis.
16. The method of claim 15 , wherein the predictive analysis results in data that is expected to be used in a time period receiving a priority higher than data that is not expected to be used within the time period.
17. The method of claim 15 , wherein the static recovery plan includes a preliminary prioritization, wherein the preliminary prioritization is adapted based on the plurality of factors.