Efficient detection of ransomware attacks within a backup storage environment

A method of detecting a ransomware threat, comprising:

• identifying, by a validation manager, a creation of a backup file that is stored within a backup storage environment, the backup storage environment further storing a fingerprint of the backup file that is generated in response to the creation of the backup file;
• requesting an initial sampling of bytes from the backup file, the request including a set of locations within the backup file from which to obtain one or more sample bytes;
• storing, in response to receiving the initial sampling of bytes from the backup storage environment, the initial sampling of bytes in a validation database that is separate from the backup storage environment;
• requesting, periodically, a subsequent sampling of bytes from the backup file, the periodic request including the locations within the backup file from which to obtain the one or more sample bytes;
• determining, in response to receiving the subsequent sampling of bytes from the backup storage environment, whether the subsequent sampling of bytes received from backup storage environment matches the initial sampling of bytes stored in the validation database;
• and
• alerting the backup storage environment that the backup file has been subjected to an unauthorized alteration, in response to determining the subsequent sampling of bytes received from the backup storage environment does not match the initial sampling of bytes stored in the validation database.

A computer program product comprising a non-transitory computer-readable medium having a computer-readable program code embodied therein to be executed by one or more processors, the program code including instructions to:

• identify a creation of a backup file that is stored within a backup storage environment, the backup storage environment further storing a fingerprint of the backup file that is generated in response to the creation of the backup file;
• request an initial sampling of bytes from the backup file, the request including a set of locations within the backup file from which to obtain one or more sample bytes;
• store, in response to receiving the initial sampling of bytes from the backup storage environment, the initial sampling of bytes in a validation database that is separate from the backup storage environment;
• request, periodically, a subsequent sampling of bytes from the backup file, the periodic request including the locations within the backup file from which to obtain the one or more sample bytes;
• determine, in response to receiving the subsequent sampling of bytes from the backup storage environment, whether the subsequent sampling of bytes received from the backup storage environment matches the initial sampling of bytes stored in the validation database;
• and
• alert the backup storage environment that the backup file has been subjected to an unauthorized alteration, in response to determining the subsequent sampling of bytes received from backup storage environment does not match the initial sampling of bytes stored in the validation database.