Systems and methods for protecting against malware attacks

A non-transitory machine-readable medium having stored thereon instructions for performing a method comprising machine-executable code which, when executed by at least one machine, causes the at least one machine to:

• detect an incoming request to write a file to a storage node;
• determine that the file is associated with a malware attack risk based on an analysis of an encryption state of data in the file;
• add an entry for the file to a file log in response to a determination that the file is associated with the malware attack risk;
• detect a presence of a malware attack based on an analysis of the file log;
• and
• generate a snapshot in response to detecting the presence of the malware attack.

A computing device comprising:

• a memory containing machine-readable medium comprising machine-executable code having stored thereon instructions for performing a method of managing a parallel file system during input/output (I/O) operation;
• and
• a processor coupled to the at least one memory, the at least one processor configured to execute the machine-executable code to cause the processor to:
• detect an incoming request to write a file to a storage node;
• determine that the file is associated with a malware attack risk based on a plurality of chi-square values computed for data blocks of the file;
• add an entry for the file to a file log in response to a determination that the file is associated with the malware attack risk;
• and
• detect a presence of a malware attack based on an analysis of the file log.