Intelligent backup system

An intelligent backup server comprising:

• a processor;
• an I/O module operative to receive files to be backed up from a target file location;
• a backup database operative to store one or more versions of said files;
• a rules database;
• and
• a backup manager application, to be executed by said processor and configured to:
• backup said files to be backed up in a backup transaction stored in said backup database,
• score a likelihood of infection of one or more of said files in said backup transaction according to rules in said rules database,
• compute a backup delta score for said backup transaction by comparing said scored likelihood of infection by an unauthorized software agent with a previously scored likelihood of infection by an unauthorized software agent from a previous said backup transaction,
• determine whether said computer backup delta score exceeds a pre-defined threshold,
• upon said computed backup delta score exceeding said pre-defined threshold:
• determine that said backup transaction is indicative of infection by an unauthorized software agent, and perform at least one counter-measure in response to said infection.

A system for ransomware-aware file backup, the system implemented on a computing device and comprising:

• means for backing up a target population of files from a target file location in a backup transaction;
• means for computing a backup delta score for said backup transaction, wherein said computing comprises comparing backup data from said backup transaction with backup data from a previous backup transaction;
• means for determining whether said computer backup delta score exceeds a pre-defined threshold;
• and
• means for upon said computed backup delta score exceeding said pre-defined threshold:
• determining that said backup transaction is indicative of a ransomware infection, and
• performing at least one counter-measure in response to said ransomware infection.