International Business Machines Corporation

Thomas Schreiber

Dominic Mueller-Wicke

Kai Boerner

Nils Haustein

Christian Mueller

Stefan Bender

Fabian Kuhl

Christian Bolik

Mauro Cruciani

Frank Mueller

A method and system for detecting ransomware and repairing data following an attack. The method includes, collecting file statistics for files in a file system, identifying an affected file based on collected file statistics, locking down of access to the file system in response to identifying the affected file, undoing of reconcile processing, repairing the affected files, and unlocking access to the file system. The system includes a computer node, a file system, a plurality of disc storage components, a backup client, a backup client, and a hierarchical storage client. The hierarchical storage client is configured to collect file statistics for files in file system, identify affected files based on collected file statistics for the file, lock down of access to the file system in response to an identified affected file, undo reconcile processing, repair the affected file; and unlock access to the file system.

Automatic ransomware detection with an on-demand file system lock down and automatic repair function

A method, computer program product, and system for detecting and mitigating ransomware using snapshot-based backups applied to a block-oriented storage device, by performing the following operations: (i) performing, in predetermined time-intervals, snapshot backups of data in a block-oriented storage device; (ii) determining at least one interval malware index value between a last snapshot backup and a next planned snapshot backup, wherein the interval malware index value is indicative of a changed block rate in stored data of storage blocks of the block-oriented storage device; and (iii) in response to determining that the interval malware index value is larger than a predefined interval malware index threshold value, triggering an emergency snapshot.

Automatic ransomware detection and mitigation

The disclosure relates to a method for archiving files of a local file system of a client system in a remote storage system. The local file system and the remote storage system are communicatively coupled via a network. The method comprises executing an archive process on an archive computer system communicatively coupled to the network. The archiving is solely controlled by the archive process. The execution causes the archive computer system to receive a configuration comprising share metadata, descriptive of a file share in the local file system, and a network address of the client system; remotely access the local file system using the configuration; scan the files of the file share to identify candidate files for archiving; and archive the candidate files by copying the candidate files to the remote storage system.

Clientless active remote archive

Operating a data processing and storage apparatus to perform continuous backup monitoring for a collection of stored file system objects. In response to changes respective to a number of the file system objects, a set of Data Management Application Program Interface (DMAPI) events is created. For each of the events, accessory file system object information relative to a file system object subject to the change is determined. The events are grouped into an event group and a unique group identifier and an overall group size count are assigned to each of the events included in the event group. The events are sent together with the respective accessory file system object information, the respective group identifier and the respective group size to a number of backup clients registered as applications. The backup clients are to process the events together with the respective accessory file system object information, the respective group identifier and the respective group size into a number of backup requests.

Data processing apparatus and method

Operating a shared nothing cluster system (SNCS) in order to perform a backup of a data element. The SNCS includes at least a first and a second storage node connected via a first network of the SNCS. The first and second storage nodes are configured to store a first set and a second set of blocks, respectively, in which the first and second set of blocks form a single data element. A backup server is connected to the first and second storage nodes, and the backup server includes a backup information table. The first and second storage nodes are configured to act as backup clients in a client-server configuration involving the backup server, upon receiving at the first and the second storage nodes a request to backup the data element. For each node of the first and second storage nodes, the node identifies one or more block sequences of consecutive blocks in a set of blocks of the data element stored in the node. The node sends the identified one or more block sequences to the backup server, and generates backup information.

Growing community of inventors

Klein-Winternheim, Germany

Thomas Schreiber