Back to results
US 2025/0063059 A1Published application
Anomaly and ransomware detection
AssigneeRubrik, Inc.
InventorsOscar Annen, Di Wu, Ajay Saini
Life of this patent
Estimating the term…
Abstract
Some examples relate generally to computer architecture software for information security and, in some more particular aspects, to machine learning based on changes in snapshot metadata for anomaly and ransomware detection in a file system.
Claims20
A system, comprising:
- one or more memories;
- and
- one or more processors configured to perform training data augmentation operations including, at least:
- generating a first file by sampling a first seed dataset that comprises first non-production data that simulates normal operation of a filesystem, wherein the first file comprises a change between two consecutive snapshots of the first seed dataset;
- generating a second file by sampling a second seed dataset that comprises second non-production data that simulates a ransomware infection of the filesystem, wherein the second file comprises a change between two consecutive snapshots of the second seed dataset;
- generating a third file comprising respective changes of respective snapshots of the first seed dataset and the second seed dataset by merging the first file and the second file;
- and
- repeating to create a new file for every file in the first seed dataset to augment training data for at least two machine-learning models.
5 more elements
A system, comprising:
- one or more processors in communication with a storage device and a production system, the one or more processors configured to perform a computer implemented method including training data augmentation operations, comprising:
- generating a first file by sampling a first seed dataset that comprises first non-production data that simulates normal operation of a filesystem, wherein the first file comprises a change between two consecutive snapshots of the first seed dataset;
- generating a second file by sampling a second seed dataset that comprises second non-production data that simulates a ransomware infection of the filesystem, wherein the second file comprises a change between two consecutive snapshots of the second seed dataset;
- generating a third file comprising respective changes of respective snapshots of the first seed dataset and the second seed dataset by merging the first file and the second file;
- and
- repeating to create a new file for every file in the first seed dataset to augment training data for at least two machine-learning models.
3 more elements
A non-transitory, machine-readable medium, comprising:
- instructions which, when read by a machine, cause the machine to perform training data augmentation operations, comprising:
- generating a first file by sampling a first seed dataset that comprises first non-production data that simulates normal operation of a filesystem, wherein the first file comprises a change between two consecutive snapshots of the first seed dataset;
- generating a second file by sampling a second seed dataset that comprises second non-production data that simulates a ransomware infection of the filesystem, wherein the second file comprises a change between two consecutive snapshots of the second seed dataset;
- generating a third file comprising respective changes of respective snapshots of the first seed dataset and the second seed dataset by merging the first file and the second file;
- and
- repeating to create a new file for every file in the first seed dataset to augment training data for at least two machine-learning models.
3 more elements
Dependencies are inferred from the claim text.