Detecting and protecting against ransomware
In a system that replicates data writes by a server to form a local copy for a local production site with local storage and a remote copy for a remote recovery site having remote storage, ransomware is detected by a decrease of more than a predetermined threshold in either or both of compression ratio or deduplication ratio in a length of data selected by a sliding time window. Upon detecting ransomware, data writes to said remote storage are stopped to minimize corruption of the remote data.
1. A method of detecting ransomware in a computer storage system having a server, a local production site having local storage, and a remote recovery site having remote storage, comprising:
replicating data of a data write from the server to form a local copy of said data for said local storage and to form a remote copy of said data for said remote storage;
inputting selected data of one of said copies to a process to transform said selected data into processed output data;
determining a value of a process ratio comprising a ratio of said selected data input to said process divided by said processed output data;
comparing said determined value of said process ratio with a previous process ratio value for data of said one copy to detect a change in said determined value of process ratio; and
upon detecting said change in said value of said determined process ratio exceeding a predetermined threshold, identifying said change to be due to ransomware encryption of said data from the server.
2. The method of claim 1 , wherein said processing comprises compressing said selected data, and said process ratio comprises a compression ratio representing an amount of compression of said selected data.
3. The method of claim 2 , wherein said identifying comprises identifying said ransomware encryption upon detecting a decrease in said compression ratio that exceeds said predetermined threshold.
4. The method of claim 1 , wherein said processing comprise deduplication of said selected data to remove redundant data, and said process ratio comprises a deduplication ratio of said selected data.
5. The method of claim 4 , wherein said identifying comprises identifying said ransomware encryption upon detecting a decrease in said deduplication ratio that exceeds said predetermined threshold.
6. The method of claim 1 , wherein said processing is applied to data of said remote copy prior to storage in said remote storage.
7. The method of claim 1 further comprising stopping writing of data to said remote storage upon detecting ransomware encryption.
8. The method of claim 1 further comprising stopping writing of data to said local storage upon detecting ransomware encryption.
9. The method of claim 1 , wherein said selected data comprises a predetermined length of data selected by a sliding time window having a predetermined time length, and wherein the method further comprises incrementing said sliding window to select additional data, and repeating said method.
10. The method of claim 9 , wherein said selected data comprises N blocks of data corresponding to said predetermined time length of said sliding window, and wherein said incrementing said sliding window comprises incrementing to select one of all new data or a mixture of new data and previously processed data.
11. A non-transitory storage medium storing executable instructions for controlling a processor to perform a method of detecting ransomware in a computer storage system having a server, a local production site having local storage, and a remote recovery site having remote storage, comprising:
replicating data of a data write from the server to form a local copy of said data for said local storage and to form a remote copy of said data for said remote storage;
inputting selected data of one of said copies to a process to transform said selected data into processed output data;
determining a value of a process ratio comprising a ratio of said selected data input to said process divided by said processed output data;
comparing said determined value of said process ratio with a previous process ratio value for data of said one copy to detect a change in said determined value of process ratio; and
upon detecting said change in said value of said determined process ratio exceeding a predetermined threshold, identifying said change to be due to ransomware encryption of said data from the server.
12. The non-transitory storage medium of claim 11 , wherein said processing comprises compressing said selected data, and said process ratio comprises a compression ratio representing an amount of compression of said selected data.
13. The non-transitory storage medium of claim 12 , wherein said identifying comprises identifying said ransomware encryption upon detecting a decrease in said compression ratio that exceeds said predetermined threshold.
14. The non-transitory storage medium of claim 11 , wherein said processing comprise deduplication of said selected data to remove redundant data, and said process ratio comprises a deduplication ratio of said selected data.
15. The non-transitory storage medium of claim 14 , wherein said identifying comprises identifying said ransomware encryption upon detecting a decrease in said deduplication ratio that exceeds said predetermined threshold.
16. The non-transitory storage medium of claim 11 , wherein said processing is applied to data of said remote copy prior to storage in said remote storage.
17. The non-transitory storage medium of claim 11 further comprising stopping writing of data to said remote storage upon detecting ransomware encryption.
18. The non-transitory storage medium claim 11 further comprising stopping writing of data to said local storage upon detecting ransomware encryption.
19. The non-transitory storage medium claim 11 , wherein said selected data comprises a predetermined length of data selected by a sliding time window having a predetermined time length, and wherein the method further comprises incrementing said sliding window to select additional data, and repeating said method.
20. The non-transitory storage medium of claim 19 , wherein said selected data comprises N blocks of data corresponding to said predetermined time length of said sliding window, and wherein said incrementing said sliding window comprises incrementing to select one of all new data or a mixture of new data and previously processed data.