Automatic ransomware detection with an on-demand file system lock down and automatic repair function

A ransomware detection and management system, comprising:

• a computer node;
• a file system;
• a plurality of disc storage components;
• a backup client;
• a backend server;
• and
• a hierarchical storage client configured to
• collect file statistics for files in file system, wherein the collected file statistics include collected file access statistics, and collected file deduplication and compression rates;
• identify an affected file based on collected file statistics;
• lock down of access to the file system in response to an identified affected file;
• undo reconcile processing;
• repair the affected file;
• unlock access to the file system;
• and
• wherein the hierarchical storage client further comprises;
• an operation and control module (OCM) configured to:
• traverse an observation and control module table (OCMt) to identify each file that is marked as an affected file;
• move the affected file to a quarantine folder;
• and
• restore a most recent version of the affected file from a storage server having a migration time stamp prior to a time stamp associated with a current version of the affected file.

A ransomware detection and management system, comprising:

• a computer node;
• a file system;
• a plurality of disc storage components;
• a backup client;
• a backend server;
• and
• a hierarchical storage client configured to
• collect file statistics for files in file system, wherein the collected file statistics include collected file access statistics, and collected file deduplication and compression rates;
• identify an affected file based on collected file statistics;
• lock down of access to the file system in response to an identified affected file;
• undo reconcile processing;
• repair the affected file;
• unlock access to the file system;
• and
• wherein the hierarchical storage client further comprises;
• an operation and control module (OCM) configured to:
• traverse an observation and control module table (OCMt) to identify each file that is marked as an affected file;
• stub the affected file;
• and
• link the stubbed version of the affected file to a version of the affected file in a storage server that was migrated prior to a timestamp associated with a current version of the affected file.