公开(公告)号：US20180024893A1

公开(公告)日：2018-01-25

申请号：US15218342

申请日：2016-07-25

Applicant: Cisco Technology, Inc.

Inventor： Yaron Sella ,  Yigal Reiss ,  Len Sundy ,  Yair Mirsky

IPC: G06F11/14 ,  G06F21/55 ,  G06N7/00

CPC classification number: G06F11/1458 ,  G06F21/554 ,  G06F21/56 ,  G06F2221/034 ,  G06N7/005

Abstract: In one embodiment, a method for ransomware-aware file backup is implemented on a computing device and includes: backing up a target population of files from a target file location in a backup transaction, computing a backup delta score for the backup transaction, where the computing comprises comparing backup data from the backup transaction with backup data from a previous backup transaction, determining whether the computer backup delta score exceeds a pre-defined threshold, and upon the computed backup delta score exceeding the pre-defined threshold: determining that the backup transaction is indicative of a ransomware infection, and performing at least one counter-measure in response to the ransomware infection.

公开(公告)号：US10346258B2

公开(公告)日：2019-07-09

申请号：US15218342

申请日：2016-07-25

Applicant: Cisco Technology, Inc.

Inventor： Yaron Sella ,  Yigal Reiss ,  Len Sundy ,  Yair Mirsky

IPC: G06F17/30 ,  G06F11/14 ,  G06N7/00 ,  G06F21/55 ,  G06F21/56

Abstract: In one embodiment, a method for ransomware-aware file backup is implemented on a computing device and includes: backing up a target population of files from a target file location in a backup transaction, computing a backup delta score for the backup transaction, where the computing comprises comparing backup data from the backup transaction with backup data from a previous backup transaction, determining whether the computer backup delta score exceeds a pre-defined threshold, and upon the computed backup delta score exceeding the pre-defined threshold: determining that the backup transaction is indicative of a ransomware infection, and performing at least one counter-measure in response to the ransomware infection.