Granted Patent B2

US 12,411,962 · App. 18/233,686 · Granted Sep 9, 2025

Inventors: Paulo Marcon (Porto Alegre, BR); Romulo Gelinger Maciel (Canoas, BR); Ronald Karr (Palo Alto, CA)

Assignee: Pure Storage, Inc.

G06F21/602G06F3/0608G06F3/0652G06F3/067

Abstract

Claims (49)

1. A method comprising:

detecting, by a data protection system, an anomaly associated with a managed run-time environment;

determining, by the data protection system based on the detecting the anomaly, that the managed run-time environment is possibly being targeted by a security threat;

disabling, by the data protection system based on the determining that the managed run-time environment is possibly being targeted by the security threat, the managed run-time environment until a remedial action associated with the managed run-time environment can be performed;

performing, by the data protection system based on the determining that the managed run-time environment is possibly being targeted by the security threat, the remedial action, the performing the remedial action comprising:

identifying a recovery dataset generated prior to the detecting the anomaly, the recovery dataset for data associated with the managed run-time environment and stored by a storage system, and

converting the recovery dataset into a protected recovery dataset that cannot be deleted without a specific instruction provided by an authorized entity;

determining, by the data protection system after the performing the remedial action, that the managed run-time environment is no longer possibly being targeted by the security threat; and

converting, by the data protection system based on the determining that the managed run-time environment is no longer possibly being targeted by the security threat, the protected recovery dataset back into the recovery dataset.

2. The method of claim 1 , wherein the detecting the anomaly associated with the managed run-time environment comprises:

determining a value of a metric associated with the managed run-time environment; and

determining that the value of the metric differs by more than a threshold amount from a baseline value of the metric associated with the managed run-time environment.

3. The method of claim 2 , wherein the metric comprises central processing unit (CPU) usage by the managed run-time environment.

4. The method of claim 2 , wherein the metric is representative of storage system access operations performed by the managed run-time environment with respect to the storage system.

5. The method of claim 2 , wherein the baseline value is representative of a historical average value for the metric over a predetermined period of time for the managed run-time environment.

6. The method of claim 2 , wherein the baseline value is representative of a value of the metric for an additional managed run-time environment that shares at least one attribute with the managed run-time environment.

7. The method of claim 1 , wherein the data associated with the managed run-time environment comprises data accessed by the managed run-time environment.

8. The method of claim 1 , wherein the data associated with the managed run-time environment comprises a backing dataset representative of run-time resources that enable operation of the managed run-time environment.

9. The method of claim 1 , wherein the performing the remedial action further comprises generating an additional recovery dataset.

10. The method of claim 1 , wherein the managed run-time environment comprises at least one of a virtual machine or a containerized application.

11. The method of claim 1 , wherein the data protection system is implemented by a controller within the storage system.

12. The method of claim 1 , wherein the data protection system is implemented by a computing system communicatively coupled to the storage system by way of a network.

13. A system comprising:

a memory storing instructions; and

one or more processors communicatively coupled to the memory and configured to execute the instructions to perform a process comprising:

detecting an anomaly associated with a managed run-time environment;

determining, based on the detecting the anomaly, that the managed run-time environment is possibly being targeted by a security threat;

disabling, based on the determining that the managed run-time environment is possibly being targeted by the security threat, the managed run-time environment until a remedial action associated with the managed run-time environment can be performed;

performing, based on the determining that the managed run-time environment is possibly being targeted by the security threat, the remedial action, the performing the remedial action comprising:

identifying a recovery dataset generated prior to the detecting the anomaly, the recovery dataset for data associated with the managed run-time environment and stored by a storage system, and

converting the recovery dataset into a protected recovery dataset that cannot be deleted without a specific instruction provided by an authorized entity;

determining, after the performing the remedial action, that the managed run-time environment is no longer possibly being targeted by the security threat; and

converting, based on the determining that the managed run-time environment is no longer possibly being targeted by the security threat, the protected recovery dataset back into the recovery dataset.

14. The system of claim 13 , wherein the detecting the anomaly associated with the managed run-time environment comprises:

determining a value of a metric associated with the managed run-time environment; and

determining that the value of the metric differs by more than a threshold amount from a baseline value of the metric associated with the managed run-time environment.

15. The system of claim 14 , wherein the metric comprises central processing unit (CPU) usage by the managed run-time environment.

16. The system of claim 14 , wherein the metric is representative of storage system access operations performed by the managed run-time environment with respect to the storage system.

17. The system of claim 14 , wherein the baseline value is representative of a historical average value for the metric over a predetermined period of time for the managed run-time environment.

18. The system of claim 14 , wherein the baseline value is representative of a value of the metric for an additional managed run-time environment that shares at least one attribute with the managed run-time environment.

19. A non-transitory computer-readable medium storing instructions that, when executed, direct a processor of a computing device to perform a process comprising:

detecting an anomaly associated with a managed run-time environment;

determining, based on the detecting the anomaly, that the managed run-time environment is possibly being targeted by a security threat;

disabling, based on the determining that the managed run-time environment is possibly being targeted by the security threat, the managed run-time environment until a remedial action associated with the managed run-time environment can be performed;

performing, based on the determining that the managed run-time environment is possibly being targeted by the security threat, the remedial action, the performing the remedial action comprising:

identifying a recovery dataset generated prior to the detecting the anomaly, the recovery dataset for data associated with the managed run-time environment and stored by a storage system, and

converting the recovery dataset into a protected recovery dataset that cannot be deleted without a specific instruction provided by an authorized entity;

determining, after the performing the remedial action, that the managed run-time environment is no longer possibly being targeted by the security threat; and

converting, based on the determining that the managed run-time environment is no longer possibly being targeted by the security threat, the protected recovery dataset back into the recovery dataset.

Assignments (1)

Continuity (37)

References Cited (400)