Detecting ransomware in secondary copies of client computing devices
An information management system includes one or more client computing devices in communication with a storage manager and a secondary storage computing device. The storage manager manages the primary data of the one or more client computing devices and the secondary storage computing device manages secondary copies of the primary data of the one or more client computing devices. Each client computing device may be configured with a ransomware protection monitoring application that monitors for changes in their primary data. The ransomware protection monitoring application may input the changes detected in the primary data into a machine-learning classifier, where the classifier generates an output indicative of whether a client computing device has been affected by malware and/or ransomware. Using a virtual machine host, a virtual machine copy of an affected client computing device may be instantiated using a secondary copy of primary data of the affected client computing device.
1. A computer-implemented method performed by a secondary storage computing device, the method comprising:
receiving data from a client computing device,
wherein the secondary storage computing device is configured to generate a first secondary copy of the data;
generating the first secondary copy of the data received from the client computing device;
determining that, compared to a second secondary copy of the data that precedes the first secondary copy, there are one or more changes in the first secondary copy,
wherein the one or more changes are determined based on an index maintained by the secondary storage computing device,
wherein the index is configured to track file system information for each secondary copy, including file system information about data files backed up within the first secondary copy and file system information about data files backed up within the second secondary copy;
providing the one or more changes to an anomaly detection model, which is deployed at the secondary storage computing device, to determine whether there is an anomaly in the first secondary copy, wherein the anomaly detection model was previously trained with file system information obtained from backup operations that generated secondary copies;
determining that there is an anomaly in the first secondary copy, based on the anomaly detection model; and
generating a notification of the anomaly to a user.
2. The computer-implemented method of claim 1 , further comprising:
displaying an identifier representing at least one file system directory based on the anomaly in the first secondary copy;
displaying an option to restore a prior version of the at least one file system directory stored as a secondary copy managed by the secondary storage computing device;
receiving an input of the option to restore to the prior version; and
restoring the prior version of the at least one file system directory to the client computing device.
3. The computer-implemented method of claim 1 , further comprising:
displaying an identifier representing the client computing device with an option to create a virtual machine copy of the client computing device;
receiving an input of the option to create the virtual machine copy of the client computing device; and
creating the virtual machine copy of the client computing device.
4. The computer-implemented method of claim 1 , further comprising:
determining a backup copy of the client computing device to use in creating a virtual machine copy of the client computing device, wherein
the backup copy is stored as a secondary copy managed by the secondary storage computing device, and
the backup copy originated from the client computing device prior to the anomaly in the secondary copy, and
creating the virtual machine copy of the client computing device from the backup copy.
5. The computer-implemented method of claim 1 , wherein the data within the first secondary copy of the data comprises one or more of: files, directories, and data structures.
6. The computer-implemented method of claim 1 , wherein the file system information about the data within the first secondary copy of the data comprises metadata generated by the secondary storage computing device in a backup operation that generated the first secondary copy of the data.
7. The computer-implemented method of claim 1 , wherein the second secondary copy of the data and the first secondary copy of the data are sequential.
8. The computer-implemented method of claim 1 , wherein the second secondary copy of the data and the first secondary copy of the data correspond to a same one or more primary data at the client computing device.
9. The computer-implemented method of claim 1 , wherein determining that there are one or more changes in the data received from the client computing device is performed by an application that monitors the index as the first secondary copy is created, wherein the application executes at the secondary storage computing device.
10. The computer-implemented method of claim 1 , the anomaly detection model determines that there is an anomaly in the first secondary copy, based on one or more differences between the first secondary copy and the second secondary copy.
11. A system comprising: one or more hardware processors and computer memory carrying computer programming instructions that configured the system to:
perform a first backup operation comprising transmitting data from a client computing device to a secondary storage computing device, wherein the secondary storage computing device is configured to generate a first secondary copy of the data received from the client computing device;
determine differences between the first secondary copy and a second secondary copy that preceded the first secondary copy, wherein the second secondary copy and the first secondary copy are sequential in the system;
wherein the differences between the first secondary copy and a second secondary copy are determined from an index maintained by the secondary storage computing device, wherein the index is configured to track file system information for each secondary copy, including file system information about first data files backed up within the first secondary copy and file system information about second data files backed up within the second secondary copy;
provide the differences to an anomaly detection model deployed at the secondary storage computing device, wherein the anomaly detection model was trained, before the first backup operation, with file system information obtained from backup operations performed in the system;
determine, by the anomaly detection model, that there is an anomaly in file system information of the data received from the client computing device and being backed up into the first secondary copy; and
generating a notification of the anomaly to a user, wherein the notification provides an indication of the first secondary copy.
12. The system of claim 11 , wherein the file system information for the first secondary copy of the data comprises metadata generated by the secondary storage computing device in the first backup operation that generated the first secondary copy.
13. The system of claim 11 , wherein the differences between the first secondary copy and the second secondary copy are determined by an application that monitors the index during the first backup operation, wherein the application executes at the secondary storage computing device.
14. The system of claim 11 , wherein the second secondary copy and the first secondary copy correspond to a same primary data at the client computing device.
15. The system of claim 11 , wherein the system is further configured to:
display an identifier representing at least one file system directory based on the anomaly in the first secondary copy;
display an option to restore a prior version of the at least one file system directory, which is stored as a secondary copy managed by the secondary storage computing device;
receive an input of the option to restore to the prior version; and
restore the prior version of the at least one file system directory to the client computing device.
16. The system of claim 11 , wherein the system is further configured to:
display an identifier representing the client computing device based on the anomaly, with an option to create a virtual machine copy of the client computing device;
receive an input of the option to create the virtual machine copy of the client computing device; and
create the virtual machine copy of the client computing device.
17. The system of claim 11 , wherein the system is further configured to:
determine a backup copy of the client computing device to use in creating a virtual machine copy of the client computing device, wherein
the backup copy is stored as a secondary copy managed by the secondary storage computing device, and
the backup copy originated from the client computing device prior to the anomaly in the first secondary copy; and
create the virtual machine copy of the client computing device based on the backup copy.