Automated ransomware identification and recovery
AssigneeKaseya US LLC
InventorsKarl Edward Brewer, Oscar Rudolph McNeese, Jr., Sameer Prakash Kamat
Life of this patent
Estimating the term…
Abstract
A method for automated ransomware identification includes receiving a first series of data items for backup from a host system, identifying, using a heuristic, a first characteristic of the first series of data items, receiving a second series of data items for backup from the host system, identifying, using the heuristic, a second characteristic of the second series of data items, detecting that the second characteristic differs from the first characteristic in a manner consistent with a ransomware infection, and invoking a recovery procedure responsive to the detecting.
Claims18
A method of managing a client system, comprising:
- recording back-up data for the client system;
- analyzing the recorded back-up data;
- wherein analyzing the recorded back-up data comprises:
- identifying an inconsistent data storage pattern based on a percentage of the back-up data being deduplicated, wherein the percentage of the back-up data being deduplicated diverges from computing systems related to the client system;
- detecting, based on the analysis, malicious activity;
- identifying, from the recorded back-up data, an infection point;
- and
- restoring the client system to a state prior to the infection point, wherein the client system is restored based on snapshots in both cloud-based object storage and cloud-based block storage.
A method of managing a client system, comprising:
- analyzing a recorded back-up data for the client system;
- wherein analyzing the recorded back-up data comprises:
- identifying an inconsistent data storage pattern based on a percentage of the back-up data being deduplicated, wherein the percentage of the back-up data being deduplicated diverges from computing systems related to the client system;
- identifying an infection point using the recorded back-up data analysis;
- generating a notification requesting authorization to restore from back-up data;
- receiving authorization to proceed with recovery;
- and
- restoring the client system to a state prior to the infection point, wherein the client system is restored based on snapshots in both cloud-based object storage and cloud-based block storage.
Dependencies are inferred from the claim text.