Ransomware infection detection in filesystems

A method for detecting ransomware infection in filesystems, comprising:

• accessing a first set of backup data corresponding to a machine, the backup data indicating changes in a filesystem of the machine during one or more time intervals, the changes including file operations to one or more files in the filesystem;
• maintaining a ransomware detection model to detect abnormal behavior associated with the filesystem including at least one model feature based at least in part on the accessed backup data associated with the machine including the changes and file operations over the one or more time intervals, wherein the ransomware detection model further includes a feature based at least in part on respective entropies of one or more files in the filesystem;
• receiving, by the ransomware detection model, a second set of backup data corresponding to the machine, the second set of backup data indicating second changes in the filesystem of the machine during a second time interval subsequent to the one or more time intervals, the second changes including file operations to one or more files in the filesystem;
• applying the second set of backup data to the ransomware detection model to screen for abnormal behavior of the filesystem, wherein the ransomware detection model is operative to assess the second changes and entropies of one or more files in the file system associated with the second time interval;
• responsive to the ransomware detection model detecting abnormal behavior, generating a user interface for presenting the determination that the filesystem is infected;
• and
• providing the user interface for display.

A non-transitory computer-readable storage medium storing computer program instructions executable by a processor, the computer program instructions configured to cause the processor to perform:

• accessing a first set of backup data corresponding to a machine, the backup data indicating changes in a filesystem of the machine during one or more time intervals, the changes including file operations to one or more files in the filesystem;
• maintaining a ransomware detection model to detect abnormal behavior associated with the filesystem including at least one model feature based at least in part on the accessed backup data associated with the machine including the changes and file operations over the one or more time intervals, wherein the ransomware detection model further includes a feature based at least in part on respective entropies of one or more files in the filesystem;
• receiving, by the ransomware detection model, a second set of backup data corresponding to the machine, the second set of backup data indicating second changes in the filesystem of the machine during a second time interval subsequent to the one or more time intervals, the second changes including file operations to one or more files in the filesystem;
• applying the second set of backup data to the ransomware detection model to screen for abnormal behavior of the filesystem, wherein the ransomware detection model is operative to assess the second changes and entropies of one or more files in the file system associated with the second time interval;
• responsive to the ransomware detection model detecting abnormal behavior, generating a user interface for presenting the determination that the filesystem is infected;
• and
• providing the user interface for display.