# US 12,182,264 B2 · Malicious activity detection, validation, and remediation in virtualized file servers > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,182,264 B2 - Document ID: US12182264B2 - Status: Granted - Kind: B2 - Application number: 17/693,206 - Filed: 2022-03-11 - Published: 2023-09-14 - Granted: 2024-12-31 - Earliest claimed: 2022-03-11 - Assignees: Nutanix, Inc. - Applicants: Nutanix, Inc. - Inventors: Pankaj Kumar Sinha; Pradeep Thomas - Web page: https://patentgrep.com/patent/US12182264B2 ## CPC - G06F 21/565: {by checking file integrity} - G06F 11/004: {Error avoidance (G06F11/07 and subgroups take precedence)} - G06F 11/1464: {for networked environments} - G06F 11/1469: {Backup restoration techniques} - G06F 21/554: {involving event detection and direct action} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/568: {eliminating virus, restoring damaged files} - G06F 2201/84: Using snapshots, i.e. a logical point-in-time copy of the data - G06F 2201/86: Event-based monitoring - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Examples of file analytics systems are described that may obtain metadata data and events data from a virtualized file server. The file analytics systems may detect one or more events from the events data matching a criteria indicating malicious activity. The file analytics systems may validate the detection of malicious activity. The validation may be performed by comparing the file type, such as the MIME type, of sample files before and after the suspected malicious activity. The systems may recover a share of the distributed file server including the one or more affected files by replacing the one or more affected files with stored versions of the one or more affected files from a snapshot of the share taken prior to the detected malicious activity. ## Claims ### Claim 1 At least one non-transitory computer readable medium encoded with instructions which, when executed, cause a system to: detect one or more file server events in a distributed file server, the one or more file server events indicative of malicious activity, the distributed file server hosting files distributed across multiple computing nodes including a first computing node and a second computing node; identify candidate files in the distributed file server, the candidate files suspected of being compromised by the malicious activity; and validate the candidate files were compromised by the malicious activity, wherein said validate comprises comparing, for a sample file of the candidate files, a file type of the sample file prior to detection of the malicious activity and a file type of the sample file after the malicious activity; and recover a share of the distributed file server including the candidate files by replacing the candidates files with stored versions from a snapshot of the share taken prior to the detected malicious activity, a first portion of the snapshot of the share at the first computing node and a second portion of the snapshot of the share at the second computing node. ### Claim 2 (depends on 1) The at least one computer readable medium of claim 1, wherein said comparing a file type of the sample file comprises comparing a MIME type of the sample file. ### Claim 3 (depends on 1) The at least one computer readable medium of claim 1, wherein said comparing validates the candidate files were compromised when the file type of the sample file after the malicious activity is an encrypted file type and the file type of the sample file before the malicious activity is other than the encrypted file type. ### Claim 4 (depends on 1) The at least one computer readable medium of claim 1, wherein said comparing comprises requesting a current file type of the sample file from the distributed file server and comparing the current file type with a previously stored file type for the sample file. ### Claim 5 (depends on 4) The at least one computer readable medium of claim 4, wherein said requesting the current file type comprises providing an identification of the sample file to the distributed file server in an API call. ### Claim 6 (depends on 1) The at least one computer readable medium of claim 1, wherein said detect one or more file server events comprises compare a sequence of events for a file of the distributed file server to one or more patterns of file server events associated with the malicious activity. ### Claim 7 (depends on 1) The at least one computer readable medium of claim 1, wherein said detect one or more file server events comprises compare a file entropy measurement of a file of the distributed file server to a threshold file entropy measurement. ### Claim 8 (depends on 1) The at least one computer readable medium of claim 1, wherein the share of the distributed file server including at least one affected file includes files distributed across the first computing node and the second computing node, wherein the instructions further cause the system to retrieve the first portion of the snapshot of the share from the first computing node and the second portion of the snapshot of the share from the second computing node. ### Claim 9 (depends on 1) The at least one computer readable medium of claim 1, wherein the instructions further cause the system to update a file blocking policy of the distributed file server based on the file server events associated with the detected malicious activity. ### Claim 10 (depends on 1) The at least one computer readable medium of claim 1, wherein the instructions further cause the system to, when recovering the share of the distributed file server including at least one affected file: mount the share and the snapshot of the share; delete the at least one affected file from the share; and copy the stored version of the at least one affected file from the snapshot of the share to the share. ### Claim 11 (depends on 1) The at least one computer readable medium of claim 1, wherein the instructions further cause the system to restrict access to at least one affected file in the distributed file server prior to recovery of the share of the distributed file server including the at least one affected file. ### Claim 12 (depends on 1) The at least one computer readable medium of claim 1, wherein the detected malicious activity is a ransomware attack. ### Claim 13 A system comprising: a distributed file server hosting files across a plurality of computing nodes including a first computing node and a second computing node; an analytics service, the analytics service configured to: detect one or more file server events in the distributed file server indicative of malicious activity; identify candidate files in the distributed file server, the candidate files suspected of being compromised by the malicious activity; and validate the candidate files were compromised by the malicious activity, wherein said validate comprises comparing, for a sample file of the candidate files, a file type of the sample file prior to detection of the malicious activity and a file type of the sample file after the malicious activity; and recover a share of the distributed file server including the candidate files at least in part by replacing the candidate files with stored versions file from a snapshot of the share taken prior to the malicious activity, a first portion of the snapshot of the share at the first computing node and a second portion of the snapshot of the share at the second computing node. ### Claim 14 (depends on 13) The system of claim 13, wherein said analytics service is configured to validate at least in part by comparing a MIME type of the sample file. ### Claim 15 (depends on 13) The system of claim 13, wherein said analytics service is configured to validate the candidate files were compromised when the file type of the sample file after the malicious activity is an encrypted file type and the file type of the sample file before the malicious activity is other than the encrypted file type. ### Claim 16 (depends on 13) The system of claim 13, wherein said analytics service is configured to request a current file type of the sample file from the distributed file server and compare the current file type with a previously stored file type for the sample file. ### Claim 17 (depends on 16) The system of claim 16, wherein said analytics service is configured to request the current file type by providing an identification of the sample file to the distributed file server in an API call. ### Claim 18 (depends on 13) The system of claim 13, wherein the analytics service is configured to detect the one or more file server events indicative of malicious activity at least in part by comparing a sequence of events for a file of the distributed file server to one or more patterns of file server events associated with the malicious activity. ### Claim 19 (depends on 13) The system of claim 13, wherein the share of the distributed file server including at least one affected file includes files distributed across the first computing node and the second computing node of the plurality of computing nodes, wherein the analytics service is further configured to retrieve the first portion of the snapshot of the share from the first computing node and the second portion of the snapshot of the share from the second computing node. ### Claim 20 (depends on 13) The system of claim 13, wherein the analytics service is further configured to update a file blocking policy of the distributed file server based on the file server events associated with the detected malicious activity. ### Claim 21 (depends on 13) The system of claim 13, wherein the analytics service is further configured to, when recovering the share of the distributed file server including at least one affected file: mount the share and the snapshot of the share; delete the at least one affected file from the share; and copy the stored version of the at least one affected file from the snapshot of the share to the share. ### Claim 22 (depends on 13) The system of claim 13, wherein the analytics service is further configured to restrict access to at least one affected file in the distributed file server prior to recovering the share of the distributed file server including the at least one affected file. ### Claim 23 (depends on 13) The system of claim 13, wherein the malicious activity is a ransomware attack. ### Claim 24 A method comprising: detecting one or more file server events in a distributed file server indicative of malicious activity, the distributed file server hosting files distributed across multiple computing nodes including a first computing node and a second computing node; identifying candidate files in the distributed file server, the candidate files suspected of being compromised by the malicious activity; validating the candidate files were compromised by the malicious activity, wherein said validating comprises comparing, for a sample file of the candidate files, a file type of the sample file prior to detection of the malicious activity and a file type of the sample file after the malicious activity; and recovering a share of the distributed file server including the candidate files by replacing the candidate files with stored versions from a snapshot of the share taken prior to the detected malicious activity, a first portion of the snapshot of the share at the first computing node and a second portion of the snapshot of the share at the second computing node. ### Claim 25 (depends on 24) The method of claim 24, wherein said comparing a file type of the sample file comprises comparing a MIME type of the sample file. ### Claim 26 (depends on 24) The method of claim 24, wherein said comparing validates the candidate files were compromised when the file type of the sample file after the malicious activity is an encrypted file type and the file type of the sample file before the malicious activity is other than the encrypted file type. ### Claim 27 (depends on 24) The method of claim 24, wherein said comparing comprises requesting a current file type of the sample file from the distributed file server and comparing the current file type with a previously stored file type for the sample file. ### Claim 28 (depends on 27) The method of claim 27, wherein said requesting the current file type comprises providing an identification of the sample file to the distributed file server in an API call. ### Claim 29 (depends on 24) The method of claim 24, further comprising detecting the one or more file server events indicative of malicious activity at least in part by comparing a sequence of events for a file of the distributed file server to one or more patterns of file server events associated with the malicious activity. ### Claim 30 (depends on 24) The method of claim 24, wherein recovering the share of the distributed file server comprises retrieving the first portion of the snapshot of the share from the first computing node of the multiple computing nodes and the second portion of the snapshot of the share from the second computing node of the multiple computing nodes. ### Claim 31 (depends on 24) The method of claim 24, further comprising updating a file blocking policy of the distributed file server based on the file server events associated with the malicious activity. ### Claim 32 (depends on 24) The method of claim 24, further comprising generating a report of the malicious activity including at least one affected file and the share including the at least one affected file. ### Claim 33 (depends on 24) The method of claim 24, wherein recovering the share of the distributed file server including at least one affected file comprises: deleting the at least one affected file from the share; and copying the stored version of the at least one affected file from the snapshot of the share to the share. ### Claim 34 (depends on 24) The method of claim 24, further comprising restricting access to at least one affected file in the distributed file server prior to recovering the share of the distributed file server including the at least one affected file. ### Claim 35 (depends on 24) The method of claim 24, wherein the detected malicious activity is a ransomware attack.