Delta anomaly detection for backups of specialized directory service assets

A non-transitory computer readable medium comprising computer readable program code, which when executed by a computer processor enables the computer processor to perform a method for managing access to file based backups (FBBs), the method comprising:

• generating, at a first point-in-time, a first FBB at a first point-in-time, wherein the first FBB comprises a first set of files of an asset at the first point-in-time;
• generating, at a second point-in-time after the first point-in-time, a second FBB at a second point-in-time, wherein the second FBB comprises a second set of files of the asset at the second point-in-time;
• performing an asset analysis on a first FBB metadata file associated with the first FBB and a second FBB metadata file associated with the second FBB to generate a differencing FBB metadata file;
• performing an anomaly analysis on the second FBB using the differencing FBB metadata file to obtain an anomaly report;
• and
• performing a remediation of the second FBB based on the anomaly report,
• wherein the remediation comprises:
• re-generating a backup of a file and to obtain a re-generated file;
• and
• storing the re-generated file in the second FBB.

A system comprising:

• a processor;
• and
• memory comprising instructions, which when executed by the processor, perform a method comprising:
• generating, at a first point-in-time, a first FBB at a first point-in-time, wherein the first FBB comprises a first set of files of an asset at the first point-in-time;
• generating, at a second point-in-time after the first point-in-time, a second FBB at a second point-in-time, wherein the second FBB comprises a second set of files of the asset at the second point-in-time;
• performing an asset analysis on a first FBB metadata file associated with the first FBB and a second FBB metadata file associated with the second FBB to generate a differencing FBB metadata file;
• performing an anomaly analysis on the second FBB using the differencing FBB metadata file to obtain an anomaly report;
• and
• performing a remediation of the second FBB based on the anomaly report,
• wherein the remediation comprises:
• identifying a file specified in the differencing FBB metadata file that has been compromised;
• retrieving a previous version of the file from the first FBB.