International Business Machines Corporation

Kai Boerner

Dominic Mueller-Wicke

Thomas Schreiber

Stefan Bender

Christian Mueller

Fabian Kuhl

Mauro Cruciani

Frank Mueller

A method and system for detecting ransomware and repairing data following an attack. The method includes, collecting file statistics for files in a file system, identifying an affected file based on collected file statistics, locking down of access to the file system in response to identifying the affected file, undoing of reconcile processing, repairing the affected files, and unlocking access to the file system. The system includes a computer node, a file system, a plurality of disc storage components, a backup client, a backup client, and a hierarchical storage client. The hierarchical storage client is configured to collect file statistics for files in file system, identify affected files based on collected file statistics for the file, lock down of access to the file system in response to an identified affected file, undo reconcile processing, repair the affected file; and unlock access to the file system.

Automatic ransomware detection with an on-demand file system lock down and automatic repair function

A method, computer program product, and system for detecting and mitigating ransomware using snapshot-based backups applied to a block-oriented storage device, by performing the following operations: (i) performing, in predetermined time-intervals, snapshot backups of data in a block-oriented storage device; (ii) determining at least one interval malware index value between a last snapshot backup and a next planned snapshot backup, wherein the interval malware index value is indicative of a changed block rate in stored data of storage blocks of the block-oriented storage device; and (iii) in response to determining that the interval malware index value is larger than a predefined interval malware index threshold value, triggering an emergency snapshot.

Automatic ransomware detection and mitigation

The disclosure relates to a method for archiving files of a local file system of a client system in a remote storage system. The local file system and the remote storage system are communicatively coupled via a network. The method comprises executing an archive process on an archive computer system communicatively coupled to the network. The archiving is solely controlled by the archive process. The execution causes the archive computer system to receive a configuration comprising share metadata, descriptive of a file share in the local file system, and a network address of the client system; remotely access the local file system using the configuration; scan the files of the file share to identify candidate files for archiving; and archive the candidate files by copying the candidate files to the remote storage system.

Clientless active remote archive

Growing community of inventors

Kelsterbach, Germany

Kai Boerner