Automation and optimization of data recovery after a ransomware attack
AssigneeEMC IP Holding Company LLC
InventorsNiamh O'Mahony, Andrew Byrne, Regis Wenner, Celine Brandy
Life of this patent
Estimating the term…
Abstract
In the face of ransomware attacks, which can be increasingly difficult to effectively prevent, a solution can be considered to be the minimization of the cost and time taken to recover data and, hence business activities. Embodiments perform a restore operation that include automatically identifying the most recent healthy backup, from which data should be restored, and the prioritizing of the order in which data should be restored.
Claims20
A method for performing a restore operation, the method comprising:
- identifying a plurality of candidate backups from which to restore production data in a computing system that has experienced an event;
- extracting features from the plurality of candidate backups;
- scoring each of the plurality of candidate backups based at least on the extracted features;
- identifying, by a backup server, a healthy backup from the plurality of candidate backups based on the scores of the plurality of backup candidates;
- restoring the production data from the identified healthy backup.
A method for performing a restore operation, the method comprising:
- determining that an event has occurred in a computing system that includes production data, wherein a plurality of candidate backups are available to the computing system such that the production data can be restored;
- identifying a healthy backup from the plurality of candidate backups by:
- extracting features from the plurality of candidates;
- augmenting the process of identifying the healthy backup with augmented data;
- evaluating the extracted features and the candidate backups based on the augmented data;
- and
- assigning a score to each of the candidate backups based on the extracted features and the augmented data;
- selecting, as the healthy backup, the candidate backup with the best score;
- and
- restoring the production data from the selected healthy backup.
A non-transitory computer readable medium comprising computer executable instructions configured for execution by a processor and configured to implement a method for performing a restore operation, the method comprising:
- determining that an event has occurred in a computing system that includes production data, wherein a plurality of candidate backups are available to the computing system such that the production data can be restored;
- identifying a healthy backup from the plurality of candidate backups by:
- extracting features from the plurality of candidates;
- augmenting the process of identifying the healthy backup with augmented data;
- evaluating the extracted features and the candidate backups based on the augmented data;
- and
- assigning a score to each of the candidate backups based on the extracted features and the augmented data;
- selecting, as the healthy backup, the candidate backup with the best score;
- and
- restoring the production data from the selected healthy backup.
Dependencies are inferred from the claim text.