Automation and optimization of data recovery after a ransomware attack
AssigneeEMC IP Holding Company LLC
InventorsNiamh O'Mahony, Andrew Byrne, Regis Wenner, Celine Brandy
Life of this patent
Estimating the term…
Abstract
In the face of ransomware attacks, which can be increasingly difficult to effectively prevent, a solution can be considered to be the minimization of the cost and time taken to recover data and, hence business activities. Embodiments perform a restore operation that include automatically identifying the most recent healthy backup, from which data should be restored, and the prioritizing of the order in which data should be restored.
Claims18
A method comprising:
- analyzing backups to identify backups that do not appear to contain active infections and that do not appear to contain dormant infections, wherein analyzing the backups includes:
- extracting features from the backups;
- augmenting the analyzing with data augmentation that includes at least one of historical data, models of behavior, and data from peers;
- and
- scoring each of the backups with a score based on the extracted features and the models of behavior;
- selecting a backup from among the identified backups based on the scores of the backups, the backup including data objects;
- identifying one or more restore factors of the data objects in the backup;
- identifying a prioritization policy;
- classifying a data priority for each data object of the data objects wherein the classification is based on the restore factors and the prioritization policy;
- and
- restoring from the backup beginning with data objects which have a highest data priority and continuing in order of decreasing data priority until all data objects have been restored.
A non-transitory computer readable medium comprising computer executable instructions configured for execution by a processor and configured to implement a method comprising:
- analyzing backups to identify backups that do not appear to contain active infections and that do not appear to contain dormant infections, wherein analyzing the backups includes:
- extracting features from the backups;
- augmenting the analyzing with data augmentation that includes at least one of historical data, models of behavior, and data from peers;
- and
- scoring each of the backups with a score based on the extracted features and the models of behavior;
- selecting a backup from among the identified backups based on the scores of the backups, the backup including data objects;
- identifying one or more restore factors of the data objects in the backup;
- identifying a prioritization policy;
- classifying a data priority for each data object of the data objects wherein the classification is based on the restore factors and the prioritization policy;
- and
- restoring from the backup beginning with data objects which have a highest data priority and continuing in order of decreasing data priority until ail data objects have been restored.
Dependencies are inferred from the claim text.