Automated ransomware identification and recovery

1. A method of managing a client system, comprising:

recording back-up data for the client system;

analyzing the recorded back-up data;

wherein analyzing the recorded back-up data comprises:

identifying an inconsistent data storage pattern based on a percentage of the back-up data being deduplicated, wherein the percentage of the back-up data being deduplicated diverges from computing systems related to the client system;

detecting, based on the analysis, malicious activity;

identifying, from the recorded back-up data, an infection point; and

restoring the client system to a state prior to the infection point, wherein the client system is restored based on snapshots in both cloud-based object storage and cloud-based block storage.

2. The method of claim 1 , wherein the recording the back-up data for the client system is performed periodically.

3. The method of claim 1 , wherein the malicious activity is ransomware activity.

4. The method of claim 1 , wherein analyzing the recorded back-up data comprises:

calculating an entropy of at least one back-up in the recorded back-up data; and

comparing the entropy of the back-up for the client system to an entropy of previous back-ups for the client system.

5. The method of claim 1 , wherein analyzing the recorded back-up data comprises:

identifying a predictable usage pattern for the back-up data for the client system; and determining a change in the predictable usage pattern based on the back-up data for the client system; and

detecting the malicious activity is based on the determined change in the predictable usage pattern.

6. The method of claim 1 , wherein analyzing the recorded back-up data comprises:

calculating an entropy of at least one back-up in the recorded back-up data; and

comparing the entropy of the back-up for the client system to an entropy of back-ups for at least one similar client system.

7. A method of managing a client system, comprising:

analyzing a recorded back-up data for the client system;

wherein analyzing the recorded back-up data comprises:

identifying an inconsistent data storage pattern based on a percentage of the back-up data being deduplicated, wherein the percentage of the back-up data being deduplicated diverges from computing systems related to the client system;

identifying an infection point using the recorded back-up data analysis;

generating a notification requesting authorization to restore from back-up data;

receiving authorization to proceed with recovery; and

restoring the client system to a state prior to the infection point, wherein the client system is restored based on snapshots in both cloud-based object storage and cloud-based block storage.

8. The method of claim 7 , further comprising generating a notification alerting an administrator to a potential problem.

9. The method of claim 7 , further comprising moving portions of the snapshot of the cloud-based object storage to the cloud-based block storage based on at least one recovery time objective.

10. The method of claim 7 , wherein detecting ransomeware activity comprises:

validating whether a file on the client system adheres to a file format designated for the file based at least in part on a file-type fingerprint; and

determining the file is non-conforming in response to the file not adhering to the file format designated for the file on the client system.

11. The method of claim 7 , wherein detecting ransomeware activity comprises:

maintaining a history of file modifications for the client system; and

analyzing file modification events to compare event trends to the history of file modifications for the client system.

12. The method of claim 7 , wherein detecting ransomeware activity comprises:

maintaining historical deduplication statistics for the client system; and

comparing new data deduplication statistics for the client system to the maintained historical deduplication statistics.

13. The method of claim 7 , wherein detecting ransomeware activity comprises:

determining whether a probability of infection exceeds a threshold probability based on factors indicating a probability of infection.

14. The method of claim 7 , wherein detecting ransomeware activity comprises:

maintaining historical deduplication data;

measuring an amount of new back-up deduplication data from the client system;

comparing the measured amount to historical deduplication data; and

determining ransomware activity in response to the measured amount being a statistical outlier from the historical deduplication data.

15. The method of claim 7 , wherein detecting ransomeware activity comprises:

maintaining historical deduplication data;

measuring an amount of new back-up deduplication data from the client system;

comparing the measured amount to historical deduplication data; and

determining ransomware activity in response to the measured amount exceeding an average amount of the historical deduplication data by at least a predetermined threshold.

16. The method of claim 7 , wherein detecting ransomeware activity comprises:

identifying an increase or change in types of file modification events corresponding to the client system.

17. The method of claim 7 , wherein detecting ransomeware activity comprises:

identifying an increase in randomness of the recorded back-up data.

18. The method of claim 7 , wherein detecting ransomeware activity comprises:

identifying a measure of consistency for the recorded back-up data; and

determining ransomware activity in response to a divergence of the recorded back-up data by more than the measure of consistency.