DATA LOSS VULNERABILITY DETECTION
    1.
    发明公开

    公开(公告)号:US20230315583A1

    公开(公告)日:2023-10-05

    申请号:US18132915

    申请日:2023-04-10

    IPC分类号: G06F11/14 G06F21/64 G06F16/17

    摘要: An information management system can detect instances in which data is being stored in a non-standard file path and can alert the user of the client computing device, modify the storage policy to include the non-standard file path, and/or initiate a secondary copy operation to prevent data loss of the data stored in the non-standard file path. For example, a client computing device may execute a filter driver that monitors interactions with files in the file system. The filter driver can identify any non-standard file paths not subject to a storage policy that include files in which interactions occurred. For a non-standard file path, the filter driver can determine whether the frequency of interaction with files in the non-standard file path satisfies a threshold frequency. If the threshold is satisfied, then the filter driver may determine that the files should be subject to the storage policy and take appropriate action.

    SKIPPING DATA BACKED UP IN PRIOR BACKUP OPERATIONS

    公开(公告)号:US20220113873A1

    公开(公告)日:2022-04-14

    申请号:US17445712

    申请日:2021-08-23

    IPC分类号: G06F3/06

    摘要: Certain embodiments described herein relate to an improved selective data backup system. In some embodiments, one or more components in an information management system can determine that a portion of the primary data scheduled for backup was previously backed up or is scheduled to be backed up as part of another backup operation. For example, a data agent performing a cluster-level backup operation for an entire cluster of storage servers may check whether any part of the primary data was previously backed up by a prior server-level backup operation for one of the storage servers in the cluster. If so, the data agent may skip, in the cluster-level backup operation, any portion of the primary data stored in the storage server previously backed up as part of the prior server-level backup operation.

    RANSOMWARE DETECTION
    4.
    发明申请

    公开(公告)号:US20190108340A1

    公开(公告)日:2019-04-11

    申请号:US16129609

    申请日:2018-09-12

    IPC分类号: G06F21/56 G06F16/17

    摘要: This application relates to ransomware detection. Ransomware typically involves an I/O heavy process of encrypting data files and/or deleting or renaming the original files. Thus, ransomware attacks may be detected by analyzing the I/O activity in a given file system. In some embodiments, a software module running on a client machine monitors the I/O activity in a file system. The software module records the number of times the files in the file system are modified, created, deleted, and renamed. The recorded number is compared against a threshold. If the number exceeds the threshold, the software module provides an alert to the user of the client machine that the client machine may be under a ransomware attack. In some embodiments, index data gathered as part of backup operations is utilized, either alone or in combination with the continuously monitored I/O activity data, to detect ransomware attacks.

    ENTROPY-BASED RANSOMWARE DETECTION
    8.
    发明公开

    公开(公告)号:US20230153438A1

    公开(公告)日:2023-05-18

    申请号:US17526936

    申请日:2021-11-15

    IPC分类号: G06F21/56 G06F21/78 G06F11/14

    摘要: A client computing device includes an entropy driver and a volume driver for protecting the client computing device against potential ransomware. The entropy driver is configured to determine one or more entropy values for a file in response to a determination that the file has been modified or changed. The determined entropy value may then be compared with a known entropy value for a filetype of the changed or modified file. Where the known entropy value and the determined entropy value differ, the volume driver may engage one or more protection operations to secure the client computing device from further corruption and/or modifications by potential ransomware and/or malware. The protection operations may include revoking and/or restricting one or more permissions on one or more storage volumes of the client computing device and backing up one or more files of the client computing device to secondary storage.

    EXTERNAL DYNAMIC VIRTUAL MACHINE SYNCHRONIZATION

    公开(公告)号:US20220206907A1

    公开(公告)日:2022-06-30

    申请号:US17550231

    申请日:2021-12-14

    摘要: Embodiments disclosed herein include systems and processes for replicating one or more user computing systems of an information management system at an external resource system to create a backup or fallback of the user computing systems. Replicating the user computing systems may include replicating data as well as the applications, operating systems and configuration of the user computing systems. This replicated or fallback user computing system may be implemented on a virtual machine at the external resource system. Thus, if a user computing system becomes inaccessible, a new user computing system can be generated based on the backup copy of the user computing system at the external resource system. Further, in some embodiments, the copy of the user computing system may be interacted with at the external resource system. Thus, certain embodiments disclosed herein can be used to transition an information management system to an external resource system.