Block-based protection from ransomware
A technique of protecting data from ransomware attacks identifies a set of blocks written to a data object between first and second points in time, determines a set of attributes of the set of blocks, and, in response to the set of attributes indicating a likelihood of a ransomware attack, secures a state of the data object as of the first point in time.
1. A method of protecting data from ransomware attacks, comprising:
identifying a set of blocks written to a data object between a first point in time and a second point in time later than the first point in time based on differences in blocks between a first snapshot of the data object taken at the first point in time and a second snapshot of the data object taken at the second point in time;
determining a set of attributes of the identified set of blocks;
processing the set of attributes to generate a current score that indicates a likelihood of a ransomware attack; and
in response to the set of attributes indicating the likelihood of the ransomware attack, securing a state of the data object as of the first point in time,
wherein the data object is hosted from a first data storage system that performs asynchronous replication with a second data storage system to maintain a replica of the data object in the second data storage system, wherein the first snapshot and the second snapshot are generated by the first data storage system as part of the asynchronous replication, and wherein processing the set of attributes is performed by the second data storage system after receiving the set of blocks.
2. The method of claim 1 , further comprising, in response to the set of attributes indicating the likelihood of the ransomware attack, sending a ransomware alert to a user.
3. The method of claim 1 , wherein securing the state of the data object includes creating a pre-attack snapshot as a copy of the first snapshot.
4. The method of claim 1 , further comprising, after the ransomware attack, restoring the data object based on the first snapshot.
5. The method of claim 1 , further comprising:
generating, over a course of multiple operations, multiple scores based on multiple respective sets of attributes;
establishing a baseline score based on the multiple scores; and
identifying a suspected ransomware attack based on the current score exceeding the baseline score by a specified amount.
6. The method of claim 5 , wherein the specified amount is user-adjustable.
7. The method of claim 1 , wherein processing the set of attributes to generate the current score includes providing a set of weights of respective attributes of the set of attributes, each of the set of weights specifying a degree to which the respective attribute contributes to the current score.
8. The method of claim 7 , further comprising adjusting the set of weights over time based on feedback, the feedback indicating whether suspected ransomware attacks indicate true ransomware attacks or false positives.
9. The method of claim 8 , wherein adjusting the set of weights is performed by a batch learning procedure that responds to determinations of suspected ransomware attacks, feedback based on the determinations, and attributes of identified sets of blocks associated with the determinations.
10. A method of protecting data from ransomware attacks, comprising:
identifying a set of blocks written to a data object between a first point in time and a second point in time later than the first point in time, including identifying differences in blocks between a first snapshot of the data object taken at the first point in time and a second snapshot of the data object taken at the second point in time;
determining a set of attributes of the identified set of blocks; and
in response to the set of attributes indicating a likelihood of a ransomware attack, securing a state of the data object as of the first point in time,
wherein determining the set of attributes includes:
providing a count of blocks in the identified set of blocks; and
providing at least one measure of entropy of the blocks in the identified set of blocks.
11. The method of claim 10 , further comprising estimating said at least one measure of entropy based on a compressibility of the blocks in the identified set of blocks and/or portions of the blocks in the identified set of blocks.
12. The method of claim 10 , wherein determining the set of attributes further includes providing a measure of sequentiality of the blocks in the identified blocks.
13. The method of claim 10 , wherein determining the set of attributes further includes providing a measure of dedupability of the blocks in the identified set of blocks.
14. The method of claim 10 , wherein determining the set of attributes further includes estimating a frequency of writes after reads to the data object.
15. The method of claim 14 , wherein estimating the frequency of writes after reads is based at least in part on a cache hit rate for writes to the data object.
16. A system, comprising a first data storage apparatus and a second data storage apparatus configured to perform replication of a data object hosted by the first data storage apparatus, each data storage apparatus including respective control circuitry formed from a respective set of processors and respective memory,
the control circuitry of the first data storage apparatus constructed and arranged to:
identify a set of blocks written to the data object between a first point in time and a second point in time later than the first point in time based on differences in blocks between a first snapshot of the data object taken at the first point in time and a second snapshot of the data object taken at the second point in time; and
send the identified set of blocks to the second data storage system, the control circuitry of the second data storage apparatus constructed and arranged to:
receive the identified set of blocks; and
in response to a set of attributes of the identified set of blocks indicating a likelihood of a ransomware attack, secure a state of the data object as of the first point in time,
wherein the control circuitry of the second data storage apparatus is further constructed and arranged to process the set of attributes to generate a current score that indicates the likelihood of the ransomware attack, including to provide a set of weights of respective attributes of the set of attributes, each of the set of weights specifying a degree to which the respective attribute contributes to the current score.
17. The system of claim 16 , wherein the control circuitry of the second data storage apparatus is further constructed and arranged to adjust the set of weights over time based on feedback, the feedback indicating whether suspected ransomware attacks indicate true ransomware attacks or false positives.
18. The system of claim 17 , wherein the control circuitry of the second data storage apparatus constructed and arranged to adjust the set of weights is further constructed and arranged to perform by a batch learning procedure that responds to determinations of suspected ransomware attacks, feedback based on the determinations, and attributes of identified sets of blocks associated with the determinations.
19. A computer program product including a set of non-transitory, computer-readable media having instructions which, when executed by control circuitry of a computerized apparatus, cause the computerized apparatus to perform a method of protecting data from ransomware attacks, the method comprising:
identifying a set of blocks written to a data object between a first point in time and a second point in time later than the first point in time based on differences in blocks between a first snapshot of the data object taken at the first point in time and a second snapshot of the data object taken at the second point in time;
determining a set of attributes of the identified set of blocks;
processing the set of attributes to generate a current score that indicates the likelihood of a ransomware attack; and
in response to the set of attributes indicating the likelihood of the ransomware attack, securing a state of the data object as of the first point in time,
wherein the method further comprises:
generating, over a course of multiple operations, multiple scores based on multiple respective sets of attributes;
establishing a baseline score based on the multiple scores; and
identifying a suspected ransomware attack based on the current score exceeding the baseline score by a specified amount.
20. The computer program product of claim 19 , wherein the specified amount is user-adjustable.