Systems and methods for measuring entropy during file backups
AssigneeCohesity, Inc.
InventorsSouvik Dutta, Surender V. Brahmaroutu
Life of this patent
Estimating the term…
Abstract
A computer-implemented method for measuring entropy during file backups may include (i) detecting an initiation of a backup process for a backup image including multiple files, wherein each of the files is associated with a set of blocks, (ii) sampling, during the backup process, a random selection of a fraction of the blocks associated with each of the files, (iii) determining an entropy value for the files based on the sampling, and (iv) performing a security action that identifies potential ransomware activity in the backup process based on the entropy value corresponding to a presence of encrypted data in the files. Various other methods, systems, and computer-readable media are also disclosed.
Claims20
A computer-implemented method for measuring entropy during file backups, at least a portion of the method being performed by one or more computing devices comprising at least one processor, the method comprising:
- detecting, by the one or more computing devices, an initiation of a backup process for a backup image comprising a plurality of files, wherein each of the plurality of files is associated with a set of blocks;
- sampling, by the one or more computing devices and in-line during the backup process before identifying a size of the backup image, a random selection of a fraction of the blocks associated with each of the files, the sampling including skipping, from sampling, at least one block from the random selection of the fraction of the blocks associated with each of the files;
- determining, by the one or more computing devices, an entropy value for the files, the determining including calculating respective entropy values for the random selection of the fraction of the blocks that are sampled prior to averaging the respective entropy values that are calculated;
- and
- performing, by the one or more computing devices, a security action that identifies potential ransomware activity in the backup process based on the entropy value corresponding to a presence of encrypted data in the files.
A system for measuring entropy during file backups, the system comprising:
- at least one physical processor;
- physical memory comprising computer-executable instructions and one or more modules that, when executed by the physical processor, cause the physical processor to:
- detect, by a detection module, an initiation of a backup process for a backup image comprising a plurality of files, wherein each of the plurality of files is associated with a set of blocks;
- sample, by a sampling module and in-line during the backup process before identifying a size of the backup image, a random selection of a fraction of the blocks associated with each of the files, the sampling including skipping, from sampling, at least one block from the random selection of the fraction of the blocks associated with each of the files;
- determine, by a determining module, an entropy value for the files based on the sampling, the determining including calculating respective entropy values for the random selection of the fraction of the blocks that are sampled prior to averaging the respective entropy values that are calculated;
- and
- perform, by a security module, a security action that identifies potential ransomware activity in the backup process based on the entropy value corresponding to a presence of encrypted data in the files.
A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
- detect an initiation of a backup process for a backup image comprising a plurality of files, wherein each of the plurality of files is associated with a set of blocks;
- sample, in-line during the backup process before identifying a size of the backup image, a random selection of a fraction of the blocks associated with each of the files, the sampling including skipping, from sampling, at least one block from the random selection of the fraction of the blocks associated with each of the files;
- determine an entropy value for the files based on the sampling, the determining including calculating respective entropy values for the random selection of the fraction of the blocks that are sampled prior to averaging the respective entropy values that are calculated;
- and
- perform a security action that identifies potential ransomware activity in the backup process based on the entropy value corresponding to a presence of encrypted data in the files.
Dependencies are inferred from the claim text.