Ransomware attack onset detection

A system comprising:

• one or more hardware processors;
• and
• a memory storing instructions that, when executed by at least one of the one or more hardware processors, causes the system to perform operations comprising:
• accessing file backup metadata for three or more computing devices;
• analyzing the file backup metadata to detect anomalous file backup activity for each of the computing devices of the three or more computing devices;
• identifying, based on the analyzing, a respective detected anomalous file backup activity for each of the computing devices, wherein each detected anomalous file backup activity has an associated detected time;
• determining whether the associated detected time of the detected anomalous file backup activity for a first computing device of the computing devices is within a predetermined time period of the associated detected time of the detected anomalous file backup activity for a second computing device of the computing devices;
• determining whether the associated detected time of the detected anomalous file backup activity for the second computing device is within the predetermined time period of the associated detected time of the detected anomalous file backup activity for a third computing device of the computing devices;
• in response to determining that the associated detected time of the detected anomalous file backup activity for the first computing device is within the predetermined time period of the associated detected time of the detected anomalous file backup activity for the second computing device and that the associated detected time of the detected anomalous, file backup activity for the second computing device is within the predetermined time period of the associated detected time of the detected anomalous file backup activity for the third computing device, determining that the detected anomalous file backup activity for the first, second, and third computing devices are correlated in time;
• accessing file description metadata for each of the computing devices;
• analyzing the file description metadata to identify files in the three or more computing devices that are anomalous to other files in the three or more computing devices;
• and
• determining whether a ransomware attack has begun based on the determination whether the detected anomalous file backup activity of at least some of the three or more computing devices is correlated in time, and based on the identified anomalous files.

A non-transitory computer-readable storage medium comprising instructions that, when executed by one or more hardware processors of a system, cause the system to perform operations comprising:

• accessing file backup metadata for three or more computing devices;
• analyzing the file backup metadata to detect anomalous file backup activity for each of the computing devices of the three or more computing devices;
• identifying, based on the analyzing, a respective detected anomalous file backup activity for each of the computing devices, wherein each detected anomalous file backup activity has an associated detected time;
• determining whether the associated detected time of the detected anomalous file backup activity for a first computing device of the computing devices is within a predetermined time period of the associated detected time of the detected anomalous file backup activity for a second computing device of the computing devices:
• determining whether the associated detected time of the detected anomalous file backup activity for the second computing device is within the predetermined time period of the associated detected time of the detected anomalous file backup activity for a third computing device of the computing devices;
• in response to determining that the associated detected time of the detected anomalous file backup activity for the first computing device is within the predetermined time period of the associated detected time of the detected anomalous file backup activity for the second computing device and that the associated detected time of the detected anomalous file backup activity for the second computing device is within the predetermined time period of the associated detected time of the detected anomalous file backup activity for the third computing device, determining that the detected anomalous file backup activity for the first, second, and third computing devices are correlated in time;
• accessing file description metadata for each of the computing devices;
• analyzing the file description metadata to identify files in the three or more computing devices that are anomalous to other files in the three or more computing devices;
• and
• determining whether a ransomware attack has begun based on the determination whether the detected anomalous file backup activity of at least some of the three or more computing devices is correlated in time, and based on the identified anomalous files.