Intelligent backup and versioning

Patent metadata

Field	Value
Publication number	US-11244047-B2
Application number	US-201916579761-A
Country	US
Kind code	B2
Filing date	Sep 23, 2019
Priority date	Dec 19, 2016
Publication date	Feb 8, 2022
Grant date	Feb 8, 2022

Abstract

There is disclosed in one example a computing apparatus, including: a processor and a memory; a network interface to communicatively couple to a backup client; a storage to receive backup data from the client, including a plurality of versions and an associated reputation for each version, the associated reputation to indicate a probability that the version is valid; and instructions encoded within the memory to instruct the processor to: receive from the backup client a request to store a new version of the backup data; determine that the client has exceeded a backup threshold; identify a backup version having a lowest reputation for validity; and expunge the backup version having the lowest reputation for validity.

First claim

What is claimed is:

1. A computing apparatus, comprising:
a processor and a memory;
a network interface to communicatively couple to a backup client;
a storage to receive backup data from the client, including a plurality of versions and an associated reputation for each version, the associated reputation to indicate a probability that the version is valid; and
instructions encoded within the memory to instruct the processor to:
receive from the backup client a request to store a new version of the backup data;
determine that the client has exceeded a backup threshold;
identify a backup version having a lowest reputation for validity; and

expunge the backup version having the lowest reputation for validity.

2. The computing apparatus of claim 1 , wherein the instructions are further to store the new version of the backup data with an associated reputation.

3. The computing apparatus of claim 1 , wherein the instructions are further to compute a reputation for the new version of the backup data.

4. The computing apparatus of claim 3 , wherein computing the reputation for the new version of the backup data comprises computing a delta between the new version and a previous version.

5. The computing apparatus of claim 4 , wherein the previous version is an immediate previous version.

6. The computing apparatus of claim 4 , wherein a magnitude of the delta is inversely proportional to the reputation.

7. The computing apparatus of claim 3 , wherein computing the reputation includes the use of contextual data.

8. The computing apparatus of claim 7 , wherein the contextual data include a data source.

9. The computing apparatus of claim 7 , wherein the contextual data include a reputation of software that initiated change to the data.

10. The computing apparatus of claim 7 , wherein the contextual data include entropy compared to a reference entity for a document or object type in the backup.

11. The computing apparatus of claim 7 , wherein the contextual data include a writing pattern of the data.

12. The computing apparatus of claim 3 , wherein the instructions are further to provide a machine learning model to compute the reputation.

13. One or more tangible, non-transitory computer-readable storage media having stored thereon executable instructions to instruct a processor to:
allocate backup data from a client device to a backup store;
associate with a plurality of backup versions in the backup store individual reputation scores, the individual reputation scores representing a reputation for validity for the backup versions;
associate with the client a quota for backups;
receive a new incoming backup from the client device;
receive from the client a new backup version;
determine that new backup version exceeds the client's quota for backups;
identify within the backup store a backup version having a lowest reputation score;
drop the backup version having the lowest reputation score; and
add the new incoming backup version to the backup store.

14. The one or more tangible, non-transitory computer-readable media of claim 13 , wherein the instructions are further to compute a reputation for the new version of the backup data, wherein the reputation comprises contextual data.

15. The one or more tangible, non-transitory computer-readable media of claim 14 , wherein computing the reputation for the new version of the backup data comprises computing a delta between the new version and a previous version.

16. The one or more tangible, non-transitory computer-readable media of claim 15 , wherein the previous version is an immediate previous version.

17. The one or more tangible, non-transitory computer-readable media of claim 14 , wherein a magnitude of the delta is inversely proportional to the reputation.

18. A computer-implemented method for remediating ransomware attacks on incremental backups, comprising:
receiving a plurality of backup versions from a client device;
associating with the backup versions individual reputations for validity;
receiving a new incremental backup version that exceeds a backup quota for the client device;
identifying from among the plurality of backup versions a backup version with a lowest reputation for validity;
removing the backup version with the lowest reputation for validity;
storing the new incremental backup version;
computing for the new incremental backup version a new reputation for validity; and
associating the new reputation for validity with the new incremental backup version.

19. The method of claim 18 , wherein computing the new reputation for validity comprises computing a delta with an immediate previous version, and assigning a reputation that varies inversely with the delta.

20. The method of claim 18 , wherein computing the new reputation for validity comprises accounting for contextual data about the new incremental backup.

Assignees

• Mcafee Llc

Inventors

• Muttik Igor
• Hunt Simon
• Cochin Cedric
• Schmugar Craig
• Leong Robert
• Beek Christiaan
• Bulygin Yury

Classifications

• G06F11/1458 Primary

  Management of the backup or restore process · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F11/1076

  Parity data used in redundant arrays of independent storages, e.g. in RAID systems · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title