Malicious software detection

A method, comprising:

• receiving an incremental backup snapshot that includes data associated with a version of a content file;
• determining, by a processor of a storage cluster, an amount of data change associated with the version of the content file included in the incremental backup snapshot with respect to one or more previous versions of the content file, wherein the incremental backup snapshot includes data associated with a primary system, wherein the data associated with the primary system is backed up from the primary system to the storage cluster, wherein the amount of data change associated with the version of the content file is determined using a tree data structure associated with the content file that is stored on the storage cluster;
• providing to a server one or more statistics associated with the incremental backup snapshot wherein the one or more statistics associated with the incremental backup snapshot include a total amount of deduplication associated with the data included in the incremental backup snapshot, wherein the server is configured to determine that the amount of data change associated with the version of the content file is anomalous based in part on the one or more statistics associated with the incremental backup snapshot, wherein the server is configured to determine that the amount of data change associated with the version of the content file is anomalous in the event the total amount of deduplication associated with the data included in the incremental backup snapshot is less than a deduplication threshold, wherein an anomalous amount of data change associated with the version of the content file indicates that the data associated with the incremental backup snapshot is potentially infected by malicious software;
• receiving from the server a notification that data associated with the incremental backup snapshot is potentially infected by malicious software;
• and
• identifying the version of the content file as being potentially infected by malicious software.

A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

• receiving an incremental backup snapshot that includes data associated with a version of a content file;
• determining an amount of data change associated with the version of the content file included in the incremental backup snapshot with respect to one or more previous versions of the content file, wherein the incremental backup snapshot includes data associated with a primary system, wherein the data associated with the primary system is backed up from the primary system to the storage cluster, wherein the amount of data change associated with the version of the content file is determined using a tree data structure associated with the content file that is stored on a storage cluster;
• providing to a server one or more statistics associated with the incremental backup snapshot wherein the one or more statistics associated with the incremental backup snapshot include a total amount of deduplication associated with the data included in the incremental backup snapshot, wherein the server is configured to determine that the amount of data change associated with the version of the content file is anomalous based in part on the one or more statistics associated with the incremental backup snapshot, wherein the server is configured to determine that the amount of data change associated with the version of the content file is anomalous in the event the total amount of deduplication associated with the data included in the incremental backup snapshot is less than a deduplication threshold, wherein an anomalous amount of data change associated with the version of the content file indicates that the data associated with the incremental backup snapshot is potentially infected by malicious software;
• receiving from the server a notification that data associated with the incremental backup snapshot is potentially infected by malicious software;
• and
• identifying the version of the content file as being potentially infected by malicious software.