Detection of anomalous backup files using known anomalous file fingerprints
Techniques are provided for detection of anomalous backup files using known anomalous file fingerprints (or other file-dependent values such as hash values, signatures and/or digest values). One method comprises obtaining first file-dependent values corresponding to respective known anomalous files; obtaining a second file-dependent value for a stored backup file; comparing the second file-dependent value to the first file-dependent values; and performing an automated remedial action in response to a result of the comparing. The second file-dependent value for the stored backup file may be determined by a backup server in response to a source file corresponding to the stored backup file being backed up by the backup server, and may be stored as part of metadata associated with the stored backup file.
1. A method, comprising:
obtaining a plurality of first file-dependent values corresponding to respective known anomalous files;
obtaining at least one second file-dependent value for at least one stored backup file, wherein the at least one second file-dependent value is computed by a backup server in response to a source file corresponding to the at least one stored backup file being backed up by the backup server, wherein the at least one second file-dependent value is based at least in part on a content of the at least one stored backup file, and wherein the at least one second file-dependent value is distinct from the at least one stored backup file;
comparing the at least one second file-dependent value to the plurality of first file- dependent values; and
performing one or more automated remedial actions in response to a result of the comparing;
wherein the method is performed by at least one processing device comprising a processor coupled to a memory.
2. The method of claim 1 , wherein one or more of the plurality of first file-dependent values and the at least one second file-dependent value comprises one or more of a hash value, a signature, a digest value and a fingerprint of a corresponding file.
3. The method of claim 1 , wherein the plurality of first file-dependent values is obtained from a third-party computer security provider.
4. The method of claim 1 , wherein the comparing the at least one second file-dependent value to the plurality of first file-dependent values comprises scanning a plurality of the at least one second file-dependent values to identify an anomalous backup file.
5. The method of claim 1 , wherein the at least one second file-dependent value for the at least one stored backup file is stored as part of metadata associated with the at least one stored backup file in connection with a backup of a source file corresponding to the at least one stored backup file.
6. The method of claim 1 , wherein the one or more automated remedial actions comprise one or more of: generating an anomalous file alert notification, suspending a backup of at least one file, suspending a restore operation with respect to the at least one stored backup file and deleting the at least one stored backup file from a backup storage device.
7. The method of claim 1 , wherein the first file-dependent value corresponding to a given known anomalous file is obtained, by the backup server, subsequent to a backup of a source file corresponding to the at least one stored backup file.
8. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory;
the at least one processing device being configured to implement the following steps:
obtaining a plurality of first file-dependent values corresponding to respective known anomalous files;
obtaining at least one second file-dependent value for at least one stored backup file, wherein the at least one second file-dependent value is computed by a backup server in response to a source file corresponding to the at least one stored backup file being backed up by the backup server, wherein the at least one second file-dependent value is based at least in part on a content of the at least one stored backup file, and wherein the at least one second file-dependent value is distinct from the at least one stored backup file;
comparing the at least one second file-dependent value to the plurality of first file-dependent values; and
performing one or more automated remedial actions in response to a result of the comparing.
9. The apparatus of claim 8 , wherein one or more of the plurality of first file-dependent values and the at least one second file-dependent value comprises one or more of a hash value, a signature, a digest value and a fingerprint of a corresponding file.
10. The apparatus of claim 8 , wherein the at least one second file-dependent value for the at least one stored backup file is stored as part of metadata associated with the at least one stored backup file in connection with a backup of a source file corresponding to the at least one stored backup file.
11. The apparatus of claim 8 , wherein the one or more automated remedial actions comprise one or more of: generating an anomalous file alert notification, suspending a backup of at least one file, suspending a restore operation with respect to the at least one stored backup file and deleting the at least one stored backup file from a backup storage device.
12. The apparatus of claim 8 , wherein the first file-dependent value corresponding to a given known anomalous file is obtained, by the backup server, subsequent to a backup of a source file corresponding to the at least one stored backup file.
13. A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform the following steps:
obtaining a plurality of first file-dependent values corresponding to respective known anomalous files;
obtaining at least one second file-dependent value for at least one stored backup file, wherein the at least one second file-dependent value is computed by a backup server in response to a source file corresponding to the at least one stored backup file being backed up by the backup server, wherein the at least one second file-dependent value is based at least in part on a content of the at least one stored backup file, and wherein the at least one second file-dependent value is distinct from the at least one stored backup file;
comparing the at least one second file-dependent value to the plurality of first file-dependent values; and
performing one or more automated remedial actions in response to a result of the comparing.
14. The non-transitory processor-readable storage medium of claim 13 , wherein one or more of the plurality of first file-dependent values and the at least one second file-dependent value comprises one or more of a hash value, a signature, a digest value and a fingerprint of a corresponding file.
15. The non-transitory processor-readable storage medium of claim 13 , wherein the at least one second file-dependent value for the at least one stored backup file is stored as part of metadata associated with the at least one stored backup file in connection with a backup of a source file corresponding to the at least one stored backup file.
16. The non-transitory processor-readable storage medium of claim 13 , wherein the one or more automated remedial actions comprise one or more of: generating an anomalous file alert notification, suspending a backup of at least one file, suspending a restore operation with respect to the at least one stored backup file and deleting the at least one stored backup file from a backup storage device.
17. The non-transitory processor-readable storage medium of claim 13 , wherein the first file-dependent value corresponding to a given known anomalous file is obtained, by the backup server, subsequent to a backup of a source file corresponding to the at least one stored backup file.
18. The method of claim 1 , wherein the comparing is performed in response to an occurrence of a trigger event comprising a request to restore the at least one stored backup file.
19. The apparatus of claim 8 , wherein the comparing is performed in response to an occurrence of a trigger event comprising a request to restore the at least one stored backup file.
20. The non-transitory processor-readable storage medium of claim 13 , wherein the comparing is performed in response to an occurrence of a trigger event comprising a request to restore the at least one stored backup file.