International Business Machines Corporation

Mauro Cruciani

Christian Mueller

Stefan Bender

Sabine U Steinhauer

Michael Loehr

Dominic Mueller-Wicke

Thomas Schreiber

Kai Boerner

Frank Mueller

Eirini Petraki

A method, computer program product, and system for detecting and mitigating ransomware using snapshot-based backups applied to a block-oriented storage device, by performing the following operations: (i) performing, in predetermined time-intervals, snapshot backups of data in a block-oriented storage device; (ii) determining at least one interval malware index value between a last snapshot backup and a next planned snapshot backup, wherein the interval malware index value is indicative of a changed block rate in stored data of storage blocks of the block-oriented storage device; and (iii) in response to determining that the interval malware index value is larger than a predefined interval malware index threshold value, triggering an emergency snapshot.

Automatic ransomware detection and mitigation

A method for handling snapshots together with migrated files in a hierarchical storage management may be provided. The method comprises managing files using a first-tier storage and a second-tier storage. The files are organized in a managed file system&#x2014;e.g., a hierarchically managed file system&#x2014;in the first-tier storage. The method comprises further creating a snapshot of a portion of the files of the first-tier storage, thereby creating a hidden directory in the file system, deleting a migrated file, and moving the stub file relating to the file to be deleted in the first-tier storage to the hidden directory.

Effective handling of HSM migrated files and snapshots

A method for accessing filesystem objects on a backup server storing block level backups, includes: receiving a request to access a filesystem object stored in the block level backups, the request including a pattern of characters identifying the filesystem object in a global history table mapping a history of filesystem objects to the block level backups; identifying, based on the pattern of characters, an object identifier in the global history table corresponding to the filesystem object; identifying, based on the object identifier, a set of one or more block level backups of the computing system having a copy of the filesystem object; selecting a block level backup from the set of one or more block level backups; mounting the selected block level backup to access a backed-up file system of the computing system; and retrieving, from the backed-up filesystem, the filesystem object.

File name level based file search and restoration from block level backups of virtual machines

A backup system retains a certain number of file versions in backups of a virtual machine running on a host computing system. Files are identified that have changed on the virtual machine since storing a backup of the virtual machine on a backup server. Host blocks on that are associated with each of the changed files are determined. Backup blocks associated with each of the host blocks are determined. The changed files and associated backup blocks are merged with previous file version information. It is determined that a version of a file has become expired, the version of the file associated with a backup block. The backup block is deleted in response to determining that the backup block is not associated with any unexpired file versions and the backup block is not associated with any unexpired virtual machine backups.

Expiration handling for block level backup of virtual machines

A method for backing a computing system includes generating a local history table of filesystem objects that have changed since storing a first backup of the computing system where the local history table includes attributes of the filesystem objects and a set of operations associated with changes to the filesystem objects. The method further includes transferring, from the computing system to a backup server, a second backup of the computing system, where the second backup includes a block level representation of a portion of a data storage medium associated with the computing system. The method additionally includes merging the local history table with a global history table stored on the backup server, the global history table mapping a history of filesystem objects to a set of block level backups of the computing system including the first backup of the computing system and the second backup of the computing system.

Growing community of inventors

Mainz, Germany

Mauro Cruciani