Fortified backup of anomaly detection
An indication to perform a backup of data stored in a persistent storage associated with a source system is received. In response to the indication to perform the backup, current execution information at least in part maintained in a volatile memory is captured. The captured current execution information is caused to be stored with backup data from the backup of the data stored in the persistent storage.
1. A method comprising:
receiving an indication to perform a first backup of data stored in a persistent storage associated with a source system, wherein the source system is running one or more objects and the data comprises object data associated with the one or more objects;
based on the indication to perform the first backup, capturing first current execution information associated with the source system, wherein the first current execution information is indicative of a first execution state of the source system;
causing the captured first current execution information to be stored with first backup data from the first backup of the data stored in the persistent storage;
capturing second current execution information associated with the source system, wherein the second current execution information is indicative of a second execution state of the source system, and wherein the first current execution information and the second current execution information each includes one or more of computer process tables, a list of one or more current running computer processes, a list of one or more scheduled computer processes, or a log of one or more recently executed computer processes;
analyzing the captured first current execution information and the captured second current execution information to determine one or more indications of an exploitation associated with the source system; and
based on the one or more indications of an exploitation associated with the source system, modifying a backup workflow.
2. The method of claim 1 , wherein the first current execution information and the second current execution information each further includes one or more of one or more connections and their corresponding status or network status information.
3. The method of claim 1 , wherein the first current execution information is obtained from a computer process table stored in a volatile memory of the source system.
4. The method of claim 1 , wherein the first current execution information is captured at one or more points in time associated with the first backup of data stored in the persistent storage associated with the source system.
5. The method of claim 4 , wherein the one or more points in time associated with the first backup of data stored in the persistent storage associated with the source system include a point in time after the indication has been received.
6. The method of claim 4 , wherein the one or more points in time associated with the first backup of data stored in the persistent storage associated with the source system include a point in time after initiation of the first backup of data stored in the persistent storage associated with the source system.
7. The method of claim 6 , wherein the one or more points in time associated with the first backup of data stored in the persistent storage associated with the source system include one or more additional points in time after initiation of the first backup of data stored in the persistent storage associated with the source system.
8. The method of claim 4 , wherein the one or more points in time associated with the first backup of data stored in the persistent storage associated with the source system include a point in time after completion of the first backup of data stored in the persistent storage associated with the source system.
9. The method of claim 1 , further comprising initiating the first backup of the data stored in the persistent storage associated with the source system.
10. The method of claim 1 , wherein the second current execution information is associated with at least one of a subsequent full backup or one or more subsequent incremental backups.
11. The method of claim 1 , wherein analyzing the captured first current execution information and the captured second current execution information to determine the one or more indications of the exploitation associated with the source system includes inputting the captured second current execution information to a machine learning model.
12. The method of claim 11 , wherein analyzing the captured first current execution information and the captured second current execution information to determine the one or more indications of the exploitation associated with the source system includes comparing a score outputted by the machine learning model to an exploitation threshold score.
13. The method of claim 12 , wherein analyzing the captured first current execution information and the captured second current execution information to determine the one or more indications of the exploitation associated with the source system includes providing a notification based on a determination that the score outputted by the machine learning model indicates that the source system has been exploited.
14. The method of claim 12 , wherein analyzing the captured first current execution information and the captured second current execution information to determine the one or more indications of the exploitation associated with the source system includes canceling one or more scheduled processes based on a determination that the score outputted by the machine learning model indicates that the source system has been exploited.
15. The method of claim 12 , wherein analyzing the captured first current execution information and the captured second current execution information to determine the one or more indications of the exploitation associated with the source system includes altering a backup workflow for a second backup of data stored in the persistent storage associated with the source system based on a determination that the score outputted by the machine learning model indicates that the source system has been exploited.
16. Non-transitory computer-readable media comprising computer instructions that, when executed by one or more processors, cause the one or more processors to:
receive an indication to perform a first backup of data stored in a persistent storage associated with a source system, wherein the source system is configured to run one or more objects and the data comprises object data associated with the one or more objects;
based on the indication to perform the first backup, capture first current execution information associated with the source system, wherein the first current execution information is indicative of a first execution state of the source system;
cause the captured first current execution information to be stored with first backup data from the first backup of the data stored in the persistent storage;
capture second current execution information associated with the source system, wherein the second current execution information is indicative of a second execution state of the source system, and wherein the first current execution information and the second current execution information each includes one or more of computer process tables, a list of one or more current running computer processes, a list of one or more scheduled computer processes, or a log of one or more recently executed computer processes;
analyze the captured first current execution information and the captured second current execution information to determine one or more indications of an exploitation associated with the source system; and
based on the one or more indications of an exploitation associated with the source system, modify a backup workflow.
17. The non-transitory computer-readable media of claim 16 , wherein the first current execution information and the second current execution information each includes one or more of one or more connections and their corresponding status or network status information.
18. The non-transitory computer-readable media of claim 16 , wherein the first current execution information is obtained from a computer process table stored in a volatile memory of the source system.
19. The non-transitory computer-readable media of claim 16 , wherein the first current execution information is captured at one or more points in time associated with the first backup of data stored in the persistent storage associated with the source system.
20. A system, comprising:
memory storing instructions; and
a processor configured to execute the instructions to:
receive an indication to perform a first backup of data stored in a persistent storage associated with a source system, wherein the source system is configured to run one or more objects and the data comprises object data associated with the one or more objects;
based on the indication to perform the first backup, capture first current execution information associated with the source system, wherein the first current execution information is indicative of a first execution state of the source system;
cause the captured first current execution information to be stored with first backup data from the first backup of the data stored in the persistent storage;
capture second current execution information associated with the source system, wherein the second current execution information is indicative of a second execution state of the source system, and wherein the first current execution information and the second current execution information each includes one or more of computer process tables, a list of one or more current running computer processes, a list of one or more scheduled computer processes, or a log of one or more recently executed computer processes;
analyze the captured first current execution information and the captured second current execution information to determine one or more indications of an exploitation associated with the source system; and
based on the one or more indications of an exploitation associated with the source system, modify a backup workflow.