JPWO2021028740A5

JPWO2021028740A5 -

Info

Publication number: JPWO2021028740A5
Application number: JP2022507554A
Authority: JP
Publication date: 2022-12-20
Anticipated expiration: 2040-07-10

Claims

A ransomware detection and management system comprising:
a computer node;
a file system;
multiple disk storage components;
a backup client;
a backend server;
A tiered storage client,
collecting file statistics for files in the file system;
identifying affected files based on the collected file statistics;
locking down access to the file system in response to identified affected files;
canceling the reconciliation process; and
repairing the affected files;
and said tiered storage client configured to: unlock access to said file system.

The collected file statistics are:
Collected file access statistics;
2. The system of claim 1, including deduplication and compression ratios of collected files.

the tiered storage client comprising:
an Observation and Control Module (OCM);
an Observation and Control Module Table (OCMt);
an extended migration module (EMM);
an extended file system reconciliation module (EFRM);
2. The system of claim 1, further comprising an extended recall module (ERM).

The OCM is
registering with the file system;
receiving a notification from the file system when a new file is created or an existing file in the file system is modified;
notifying the EMM of the new file or the changed file;
4. The system of claim 3, configured to: initiate a pre-migration of the new file or the modified file.

The OCM is
5. The method of claim 4, further configured to register a change tracking process on the new file or the existing file to receive notification when write access occurs to the new file or the existing file. System as described.

The OCM is
6. The system of claim 5, further configured to add data associated with the file to the OCMt in response to receiving notification of write access to the file.

the data associated with the file comprising:
a file name of the file;
7. The system of claim 6, comprising time of access to said file.

The OCM is
7. Further configured to add second or subsequent data associated with said file to said OCMt in response to a second or subsequent notification of write access to said file. The system described in .

The EMM is
calculating deduplication and compression ratios of the files during pre-migration of the files;
informing the OCM of the deduplication and compression ratios;
4. The system of claim 3, configured to: enter the deduplication ratio and compression ratio of the file into an entry for the file in the OCMt.

10. The system of claim 9, wherein the EMM is further configured to collect the deduplication and compression ratios as files are migrated.

The EMM is
generating a block level hash map of the files during the first pre-migration;
generating a second block level hash map of the file during a second pre-migration of the file;
comparing the block level hash map with the second block level hash map;
determining that predetermined portions of the compared block-level hash maps do not match;
identifying the file as affected in response to exceeding the predetermined portion;
4. The system of claim 3, further comprising the OCM further configured to store the block level hash map of the file in the OCMt.

4. The system of claim 3, wherein the OCM is further configured to determine whether an abnormal amount of file write accesses has occurred to the file system.

The OCM is
traversing the OCMt;
creating a sum of file write accesses in the OCMt for the most recent observation cycle;
13. The system of claim 12, further configured to: create a sum of write accesses of the file in the OCMt for a look cycle prior to the latest look cycle.

The OCM is
traversing the OCMt;
for each file in the table that was accessed in the previous observation cycle, reading each file's associated deduplication and compression ratio entries from the OCMt as the most recent ratio;
calculating, for each file, the current deduplication and compression ratios of said associated files as current ratios;
comparing the current ratio for each file with the latest ratio of the corresponding file from the previous viewing cycle;
13. The method of claim 12, further configured to: determine that there is abnormal file access to the associated file if the current ratio is lower than the latest ratio. system.

4. The system of claim 3, wherein the OCM is further configured to define a level of permitted write access to the files within the file system.

The OCM is
defining an observation interval in which the operations and control module checks for ransomware attacks;
calculating an average amount of written files in the file system over a predetermined number of observation intervals;
calculating a distribution of the average amount;
calculating the amount of files written during the current observation interval;
comparing the amount of files written during the current observation interval to a calculated average;
determining whether the amount of files written during the current observation interval exceeds a predetermined rate of change compared to the calculated average;
If the predetermined rate of change is exceeded,
traversing the OCMt to identify all files modified within the previous observation interval;
determining, for each modified file, whether the entire file has been modified and whether the deduplication and compression ratios have decreased;
16. The system of claim 15, further configured to perform, if determined to be affirmative, determining that the file is an affected file.

The OCM is
determining whether an abnormal amount of file write accesses has occurred to the file system;
4. The system of claim 3, further configured to: define a level of allowed write access to the files in the file system.

The OCM is
traversing the OCMt to determine if a threshold number of files have been marked as affected files;
blocking further write access to the file system;
the EMM is configured to stop all migration processing in response to notification of the shutdown by the OCM;
4. The system of claim 3, wherein the EFRM is configured to stop all reconciliation processing in response to notification of the shutdown by the OCM.

The OCM is
traversing the OCMt to identify each file marked as an affected file;
moving the affected file to a quarantine folder;
and restoring the latest version of the affected file from a storage server having a migration timestamp prior to the timestamp associated with the current version of the affected file. 4. The system of claim 3, further configured to:

The OCM is
traversing the OCMt to identify each file marked as an affected file;
creating a stub for the affected file;
Linking a stub version of the affected file to a version of the affected file in a storage server migrated prior to a timestamp associated with the current version of the affected file. 4. The system of claim 3, further configured to: