Coordinating cyber intrustion detection and data protection for responding to ransomware attacks

Abstract

Cyber intrusion detection (CID) and data protection (DP) are coordinated within a storage node to enable the capabilities of DP to be automatically and quickly utilized in response to detected threats to help protect data. CID sends an alert message to DP in response to detection of a ransomware attack or other threat. DP responds to the alert message by implementing at least one countermeasure, such as: generating new targetless snapshots of the storage objects under attack, the version data group of which the storage objects are members, or all storage objects maintained by the storage array; securing and/or preserving some of the targetless snapshots that existed before the infection; changing the targetless snapshot generation and retention schedule; and temporarily halting generation of new targetless snapshots.

Dependencies are inferred from the claim text.