RAPID RANSOMWARE DETECTION AND RECOVERY
Solutions for rapid ransomware detection and recovery include: receiving a first set of in-memory changed data blocks; identifying, within the first set of in-memory changed data blocks, a second set of in-memory changed data blocks addressed for storage within a file index for a virtual machine (VM) disk; determining, relative to a change history of the file index, an anomalous condition; based on at least determining the anomalous condition, identifying a third set of blocks within the file index that are changed between two versions of the VM disk; determining that changes in the third set of blocks indicate ransomware; and based on at least determining that changes in the third set of blocks indicate ransomware, generating an alert. Machine learning (ML) models may perform anomaly/ransomware detection. Remediation activities may include disk restoration storing the VM memory.
1 . A computerized method of ransomware detection, the method comprising:
receiving a first set of in-memory changed data blocks;
identifying, within the first set of in-memory changed data blocks, a second set of in-memory changed data blocks addressed for storage within a file index for a virtual machine (VM) disk;
determining, relative to a change history of the file index, an anomalous condition; and
based on at least determining the anomalous condition, generating a first alert.
2 . The method of claim 1 , further comprising:
based on at least determining the anomalous condition, performing a first remedial action selected from the group consisting of: suspending back-up file expirations, storing a copy of a VM memory, tagging a VM, and storing a VM state.
3 . The method of claim 1 , further comprising:
based on at least determining the anomalous condition, identifying a third set of blocks within the file index that are changed between two versions of the VM disk;
determining that changes in the third set of blocks indicate ransomware; and
based on at least determining that changes in the third set of blocks indicate ransomware, generating a second alert.
4 . The method of claim 1 , wherein
receiving the set of in-memory changed data blocks comprises intercepting an incremental back-up data stream; or
receiving the set of in-memory changed data blocks comprises intercepting an incremental file save data stream, wherein the in-memory changed data blocks have not been read from a persistent storage.
5 . The method of claim 1 , wherein the file index comprises a set of file records for files in the VM disk, and wherein each file in the VM disk has a corresponding file record.
6 . The method of claim 1 , wherein determining the anomalous condition comprises determining at least one ransomware indication selected from the group consisting of: a count of in-memory changed blocks, timing of in-memory changed blocks, a file extension correlated with ransomware, and entropy of file names.
7 . The method of claim 1 , wherein a machine learning (ML) model determines the anomalous condition.
8 . A computer system for ransomware detection, the system comprising:
a processor; and
a non-transitory computer readable medium having stored thereon program code executable by the processor, the program code causing the processor to:
receive a first set of in-memory changed data blocks;
identify, within the first set of in-memory changed data blocks, a second set of in-memory changed data blocks addressed for storage within a file index for a virtual machine (VM) disk;
determine, relative to a change history of the file index, an anomalous condition; and
based on at least determining the anomalous condition, generate a first alert.
9 . The computer system of claim 8 , wherein the program code is further operative to:
based on at least determining the anomalous condition, perform a first remedial action selected from the group consisting of: suspending back-up file expirations, storing a copy of a VM memory, tagging a VM, and storing a VM state.
10 . The computer system of claim 8 , wherein the program code is further operative to:
based on at least determining the anomalous condition, identify a third set of blocks within the file index that are changed between two versions of the VM disk;
determine that changes in the third set of blocks indicate ransomware; and
based on at least determining that changes in the third set of blocks indicate ransomware, generate a second alert.
11 . The computer system of claim 8 , wherein
receiving the set of in-memory changed data blocks comprises intercepting an incremental back-up data stream; or
receiving the set of in-memory changed data blocks comprises intercepting an incremental file save data stream, wherein the in-memory changed data blocks have not been read from a persistent storage.
12 . The computer system of claim 8 , wherein the file index comprises a set of file records for files in the VM disk, and wherein each file in the VM disk has a corresponding file record.
13 . The computer system of claim 8 , wherein determining the anomalous condition comprises determining at least one ransomware indication selected from the group consisting of: a count of in-memory changed blocks, timing of in-memory changed blocks, a file extension correlated with ransomware, and entropy of file names.
14 . The computer system of claim 8 , wherein a machine learning (ML) model determines the anomalous condition.
15 . A non-transitory computer storage medium having stored thereon program code executable by a processor, the program code embodying a method comprising:
receiving a first set of in-memory changed data blocks;
identifying, within the first set of in-memory changed data blocks, a second set of in-memory changed data blocks addressed for storage within a file index for a virtual machine (VM) disk;
determining, relative to a change history of the file index, an anomalous condition; and
based on at least determining the anomalous condition, generating a first alert.
16 . The computer storage medium of claim 15 , wherein the program code method further comprises:
based on at least determining the anomalous condition, performing a first remedial action selected from the group consisting of: suspending back-up file expirations, storing a copy of a VM memory, tagging a VM, and storing a VM state.
17 . The computer storage medium of claim 15 , wherein the program code method further comprises:
based on at least determining the anomalous condition, identifying a third set of blocks within the file index that are changed between two versions of the VM disk;
determining that changes in the third set of blocks indicate ransomware; and
based on at least determining that changes in the third set of blocks indicate ransomware, generating a second alert.
18 . The computer storage medium of claim 15 , wherein
receiving the set of in-memory changed data blocks comprises intercepting an incremental back-up data stream; or
receiving the set of in-memory changed data blocks comprises intercepting an incremental file save data stream, wherein the in-memory changed data blocks have not been read from a persistent storage.
19 . The computer storage medium of claim 15 , wherein the file index comprises a set of file records for files in the VM disk, and wherein each file in the VM disk has a corresponding file record.
20 . The computer storage medium of claim 15 , wherein determining the anomalous condition comprises determining at least one ransomware indication selected from the group consisting of: a count of in-memory changed blocks, timing of in-memory changed blocks, a file extension correlated with ransomware, and entropy of file names.