Efficient detection of ransomware attacks within a backup storage environment
Described is a system that efficiently detects ransomware attacks within a storage environment. The system may perform a specialized validation by comparing a sampling of backup data obtained from a storage environment with a sampling of data maintained by a specialized validation database. Accordingly, if there is a discrepancy between the samples, the system may issue an alert indicating the original backup data may be encrypted as part of a ransomware attack. The system may utilize the specialized sampling as a validation technique in addition, or as an alternative, to relying on data fingerprints for validation. For example, malicious code may be configured to cause the storage environment to provide fingerprints prior to an unauthorized encryption as an attempt to deceive certain validation processes. Accordingly, to counteract such attempts, the system may rely on the sampling of data, instead of relying solely on a fingerprint comparison.
1. A system comprising:
one or more processors; and
a non-transitory computer readable medium storing a plurality of instructions, which when executed, cause the one or more processors to:
identify a creation of a backup file that is stored within a backup storage environment, the backup storage environment further storing a fingerprint of the backup file that is generated in response to the creation of the backup file;
request an initial sampling of bytes from the backup file, the request including a set of locations within the backup file from which to obtain one or more sample bytes;
store, in response to receiving the initial sampling of bytes from the backup storage environment, the initial sampling of bytes in a validation database that is separate from the backup storage environment;
request, periodically, a subsequent sampling of bytes from the backup file, the periodic request including the locations within the backup file from which to obtain the one or more sample bytes;
determine, in response to receiving the subsequent sampling of bytes from the backup storage environment, whether the subsequent sampling of bytes received from the backup storage environment matches the initial sampling of bytes stored in the validation database; and
alert the backup storage environment that the backup file has been subjected to an unauthorized alteration, in response to determining the subsequent sampling of bytes received from backup storage environment does not match the initial sampling of bytes stored in the validation database.
2. The system of claim 1 , wherein the backup file is subjected to the unauthorized alteration without detection by the backup storage environment, and the fingerprint of the backup file stored within the backup storage environment remains unchanged after the unauthorized alteration.
3. The system of claim 2 , wherein the unauthorized alteration is performed by malicious code executed within the backup storage environment.
4. The system of claim 3 , wherein the malicious code is configured to cause the backup storage environment to provide the unchanged fingerprint in response to a request for a current fingerprint of the backup file.
5. The system of claim 1 , wherein the plurality of instructions, when executed, further cause the one or more processors to:
store, in response to identifying the creation of the backup file, a copy of the fingerprint of the backup file in the validation database;
request, as part of a security policy, a current fingerprint of the backup file stored within the backup storage environment; and
determine whether the current fingerprint stored within the backup storage environment matches the copy of the fingerprint stored within the validation database.
6. The system of claim 5 , wherein alerting the backup storage environment includes alerting the backup storage environment that the backup file has been subjected to the unauthorized alteration despite determining the current fingerprint stored within the backup storage environment matches the copy of the fingerprint stored within the validation database.
7. The system of claim 1 , wherein the plurality of instructions, when executed, further cause the one or more processors to:
determine the set of locations within the backup file from which to obtain the one or more sample bytes based on a random selection of locations specific to the backup file.
8. The system of claim 1 , wherein the unauthorized alteration comprises an unauthorized encryption.
9. A method of detecting a ransomware threat, comprising:
identifying, by a validation manager, a creation of a backup file that is stored within a backup storage environment, the backup storage environment further storing a fingerprint of the backup file that is generated in response to the creation of the backup file;
requesting an initial sampling of bytes from the backup file, the request including a set of locations within the backup file from which to obtain one or more sample bytes;
storing, in response to receiving the initial sampling of bytes from the backup storage environment, the initial sampling of bytes in a validation database that is separate from the backup storage environment;
requesting, periodically, a subsequent sampling of bytes from the backup file, the periodic request including the locations within the backup file from which to obtain the one or more sample bytes;
determining, in response to receiving the subsequent sampling of bytes from the backup storage environment, whether the subsequent sampling of bytes received from backup storage environment matches the initial sampling of bytes stored in the validation database; and
alerting the backup storage environment that the backup file has been subjected to an unauthorized alteration, in response to determining the subsequent sampling of bytes received from the backup storage environment does not match the initial sampling of bytes stored in the validation database.
10. The method of claim 9 , wherein the backup file is subjected to the unauthorized alteration without detection by the backup storage environment, and the fingerprint of the backup file stored within the backup storage environment remains unchanged after the unauthorized alteration.
11. The method of claim 10 , wherein the unauthorized alteration is performed by malicious code executed within the backup storage environment, and the malicious code is configured to cause the backup storage environment to provide the unchanged fingerprint in response to a request for a current fingerprint of the backup file.
12. The method of claim 9 , further comprising:
storing, in response to identifying the creation of the backup file, a copy of the fingerprint of the backup file in the validation database;
requesting, as part of a security policy, a current fingerprint of the backup file stored within the backup storage environment; and
determining whether the current fingerprint stored within the backup storage environment matches the copy of the fingerprint stored within the validation database.
13. The method of claim 12 , wherein alerting the backup storage environment includes alerting the backup storage environment that the backup file has been subjected to the unauthorized alteration despite determining the current fingerprint stored within the backup storage environment matches the copy of the fingerprint stored within the validation database.
14. The method of claim 9 , further comprising:
determining the set of locations within the backup file from which to obtain the one or more sample bytes based on a random selection of locations specific to the backup file.
15. A computer program product comprising a non-transitory computer-readable medium having a computer-readable program code embodied therein to be executed by one or more processors, the program code including instructions to:
identify a creation of a backup file that is stored within a backup storage environment, the backup storage environment further storing a fingerprint of the backup file that is generated in response to the creation of the backup file;
request an initial sampling of bytes from the backup file, the request including a set of locations within the backup file from which to obtain one or more sample bytes;
store, in response to receiving the initial sampling of bytes from the backup storage environment, the initial sampling of bytes in a validation database that is separate from the backup storage environment;
request, periodically, a subsequent sampling of bytes from the backup file, the periodic request including the locations within the backup file from which to obtain the one or more sample bytes;
determine, in response to receiving the subsequent sampling of bytes from the backup storage environment, whether the subsequent sampling of bytes received from the backup storage environment matches the initial sampling of bytes stored in the validation database; and
alert the backup storage environment that the backup file has been subjected to an unauthorized alteration, in response to determining the subsequent sampling of bytes received from backup storage environment does not match the initial sampling of bytes stored in the validation database.
16. The computer program product of claim 15 , wherein the backup file is subjected to the unauthorized alteration without detection by the backup storage environment, and the fingerprint of the backup file stored within the backup storage environment remains unchanged after the unauthorized alteration.
17. The computer program product of claim 16 , wherein the unauthorized alteration is performed by malicious code executed within the backup storage environment, and the malicious code is configured to cause the backup storage environment to provide the unchanged fingerprint in response to a request for a current fingerprint of the backup file.
18. The computer program product of claim 15 , wherein the program code includes further instructions to:
store, in response to identifying the creation of the backup file, a copy of the fingerprint of the backup file in the validation database;
request, as part of a security policy, a current fingerprint of the backup file stored within the backup storage environment; and
determine whether the current fingerprint stored within the backup storage environment matches the copy of the fingerprint stored within the validation database.
19. The computer program product of claim 18 , wherein alerting the backup storage environment includes alerting the backup storage environment that the backup file has been subjected to the unauthorized alteration despite determining the current fingerprint stored within the backup storage environment matches the copy of the fingerprint stored within the validation database.
20. The computer program product of claim 15 , wherein the program code includes further instructions to:
determine the set of locations within the backup file from which to obtain the one or more sample bytes based on a random selection of locations specific to the backup file.