Reducing impact of malware/ransomware in caching environment

A method for reducing impact of malware in a caching environment comprising:

• identifying one or more file operations associated with one or more malicious patterns by comparing the one or more file operations to the one or more malicious patterns, wherein the identified one or more file operations act on data stored at a first data site and the data is replicated at one or more additional sites;
• providing an alert that the one or more malicious patterns have been identified in the identified one or more file operations;
• determining an administration action in response to the alert;
• and
• performing a replication action for the identified one or more file operations based on the administration action, wherein the replication action performed in relation to replicated data stored at a second data site different from the first data site, and to assure a safe file operation:
• the identified one or more file operations associated with the one or more malicious patterns are not replayed at the second data site, and
• one or more file operations not associated with the one or more malicious patterns is replayed at the second data site.

A computer program product embodied in a computer-readable storage medium including program instructions therewith for reducing impact of malware in a caching environment, the program instructions executable by a hardware processor to cause the hardware processor to:

• identify one or more file operations associated with one or more malicious patterns by comparing the one or more file operations to the one or more malicious patterns, where the identified one or more file operations act on data stored at a first data site and the data is replicated at one or more additional sites;
• provide an alert to administrators that the one or more malicious patterns have been identified in the identified one or more file operations;
• determine an administration action in response to the alert;
• and
• perform a replication action for the identified one or more file operations based on the administration action, wherein the replication action is performed in relation to replicated data stored at a second data site different from the first data site, and to assure a sale file operation:
• the identified one or more file operations associated with the one or more malicious patterns are not replayed at the second data site, and
• one or more lie operations not associated with the one or more malicious patterns is replayed at the second data site.