Comm Vault Systems, Inc.

Sri Karthik Bhagi

Rahul S Pawar

Parag Gokhale

Prosenjit Sinha

Sunil Kumar Gutta

Rajiv Kottomtharayil

Henry Wallace Dornemann

Manoj Kumar Pradhan

Jun H Ahn

Manas Bhikchand Mutha

Dmitriy Borisovich Zakharkin

Arun Prabu Duraisamy

Vipul Pawale

Pushpendra Singh

Sanath Kumar

Jaya Rama Raju Inavolu

Ananda Venkatesha

Sumer Dilip Deshpande

Ashwin Gautamchand Sancheti

Vijay H Agrawal

PurnaChandra Sekhar Bedhapudi

Paramasivam Kumarasamy

Amit Mitkar

Sumedh Pramod Degaonkar

Duncan Alden Littlefield

Prasad Nara

Mrityunjay Upadhyay

Kuldeep Kumar

Check Abdoul Cader Sabjan

Pratima Laxman Gadhave

Marcelo Dos Reis Mansano

Jon-Paul Futey

Shyam Sundar Ramkumar

Deepak Raghunath Attarde

Arun Prasad Amarendran

Bhavyan Bharatkumar Mehta

Amit Bhaskar Ausarkar

Douglas Cary Swallow

Akhilesh Naga Wathada

Purnachandra Sekhar Bedhapudi

An information management system includes one or more client computing devices in communication with a storage manager and a secondary storage computing device. The storage manager manages the primary data of the one or more client computing devices and the secondary storage computing device manages secondary copies of the primary data of the one or more client computing devices. Each client computing device may be configured with a ransomware protection monitoring application that monitors for changes in their primary data. The ransomware protection monitoring application may input the changes detected in the primary data into a machine-learning classifier, where the classifier generates an output indicative of whether a client computing device has been affected by malware and/or ransomware. Using a virtual machine host, a virtual machine copy of an affected client computing device may be instantiated using a secondary copy of primary data of the affected client computing device.

Detecting ransomware in monitored data

Virtual machine (VM) proliferation may be reduced through the use of Virtual Server Agents (VSAs) assigned to a group of VM hosts that may determine the availability of a VM to perform a task. Tasks may be assigned to existing VMs instead of creating a new VM to perform the task. Furthermore, a VSA coordinator may determine a grouping of VMs or VM hosts based on one or more factors associated with the VMs or the VM hosts, such as VM type or geographical location of the VM hosts. The VSA coordinator may also assign one or more VSAs to facilitate managing the group of VM hosts. In some embodiments, the VSA coordinators may facilitate load balancing of VSAs during operation, such as during a backup operation, a restore operation, or any other operation between a primary storage system and a secondary storage system.

Virtual server agent load balancing

A client computing device includes an entropy driver and a volume driver for protecting the client computing device against potential ransomware. The entropy driver is configured to determine one or more entropy values for a file in response to a determination that the file has been modified or changed. The determined entropy value may then be compared with a known entropy value for a filetype of the changed or modified file. Where the known entropy value and the determined entropy value differ, the volume driver may engage one or more protection operations to secure the client computing device from further corruption and/or modifications by potential ransomware and/or malware. The protection operations may include revoking and/or restricting one or more permissions on one or more storage volumes of the client computing device and backing up one or more files of the client computing device to secondary storage.

Entropy-based ransomware detection

A system for performing continuous transaction log backups with minimal resource usage of the client computing devices that are processing the transactions is disclosed. The system detects at least one input/output (I/O) activity at a client computing device. The I/O activity can be associated with at least one database operation performed via the client computing device. The system then executes one or more native commands to backup transactions log data associated with the detected I/O activity to a virtualized location. Backing-up the transactions log data comprises dynamically identifying a mount path location corresponding to the virtualized location, and transferring the transactions log data to the dynamically identified mount path using the one or more native commands. The system can then perform data processing operations (for example, data chunking and deduplicating) on the transactions log data after it is received at the dynamically identified mount path location.

Continuously run log backup with minimal configuration and resource usage from the source machine

An illustrative data storage management system comprises a management database that stores administrative preferences and system configurations, as well as results and/or statistics of completed secondary storage operations, i.e., information needed by the system to protect customers' data and to track and recover the protected data, including secondary copies such as backup copies, archive copies, etc. The disclosed data storage management system is configured to protect its own system data subject to a very aggressive (short) Recovery Point Objective (RPO), by using an innovative infrastructure that enables the system's storage manager to fail over to any number of other failover destination storage managers, each one comprising a destination management database. An illustrative database granularly tracks whether each and every transaction log file has been successfully applied to each and every destination management database to synchronize with the source management database.

Resiliency of a data storage system by protecting its management database to meet a recovery point objective (RPO)

An improved content indexing (CI) system is disclosed herein. For example, the improved CI system may include a distributed architecture of client computing devices, media agents, a single backup and CI database, and a pool of servers. After a file backup occurs, the backup and CI database may include file metadata indices and other information associated with backed up files. Servers in the pool of servers may, in parallel, query the backup and CI database for a list of files assigned to the respective server that have not been content indexed. The servers may then request a media agent to restore the assigned files from secondary storage and provide the restored files to the servers. The servers may then content index the received restored files. Once the content indexing is complete, the servers can send the content index information to the backup and CI database for storage.

Distributed framework for data proximity-based task splitting in a content indexing system

An information management system can detect instances in which data is being stored in a non-standard file path and can alert the user of the client computing device, modify the storage policy to include the non-standard file path, and/or initiate a secondary copy operation to prevent data loss of the data stored in the non-standard file path. For example, a client computing device may execute a filter driver that monitors interactions with files in the file system. The filter driver can identify any non-standard file paths not subject to a storage policy that include files in which interactions occurred. For a non-standard file path, the filter driver can determine whether the frequency of interaction with files in the non-standard file path satisfies a threshold frequency. If the threshold is satisfied, then the filter driver may determine that the files should be subject to the storage policy and take appropriate action.

Data loss vulnerability detection

This application relates to ransomware detection and data pruning management. Ransomware typically involves an I/O heavy process of encrypting data files and/or deleting or renaming the original files. Thus, ransomware attacks may be detected by analyzing the I/O activity in a given file system. In some embodiments, a software module running on a client machine manages copying, archiving, migrating, and/or replicating of primary data and restoring and/or pruning secondary data (e.g., backup copies of the primary data). When a potential ransomware attack is detected, the software module is immediately stopped so that the software module does not prune any data that may need to be restored. Upon receiving user input that indicates that the client machine is not under a ransomware attack, the software module is allowed to resume its operations, including pruning of the secondary data.

Ransomware detection and data pruning management

Certain embodiments described herein relate to an improved selective data backup system. In some embodiments, one or more components in an information management system can determine that a portion of the primary data scheduled for backup was previously backed up or is scheduled to be backed up as part of another backup operation. For example, a data agent performing a cluster-level backup operation for an entire cluster of storage servers may check whether any part of the primary data was previously backed up by a prior server-level backup operation for one of the storage servers in the cluster. If so, the data agent may skip, in the cluster-level backup operation, any portion of the primary data stored in the storage server previously backed up as part of the prior server-level backup operation.

Skipping data backed up in prior backup operations

Protecting a management database of a data storage management system to meet a recovery point objective (RPO)

Detecting ransomware in secondary copies of client computing devices

A method and system for migrating data and metadata from a first backup system to a second backup system via a staging system is disclosed. The system accesses the backup data from the first backup system and restores it, along with the associated metadata, to a staging system. A metadata file is created at the staging system which comprises of the metadata that is to be migrated to the second backup system. The system then migrates the data from the staging system to the second backup system. The metadata is also migrated to the second backup system in a format such that it can be indexed. As a result, the migrated data can be browsed and searched based on one or more search criteria based on the associated metadata. Other details are provided herein.

Migrating data and metadata from a backup system

Growing community of inventors

Morganville, NJ, United States of America

Sri Karthik Bhagi