|
1. A method of detecting ransomware activity, comprising: implementing an asynchronous remote data replication facility between a primary storage array and a remote storage array, in which data contained in a first set of storage volumes of a first remote data replication storage group at the primary storage array is copied in an asynchronous manner from the primary storage array to the remote storage array to replicate the data in a second set of storage volumes of a second remote data replication storage group at the remote storage array; receiving host read and write operations on the first set of storage volumes by the primary storage array during a capture cycle; generating a remote data replication update including all of the host write operations on the first set of storage volumes during the capture cycle; generating a host input/output (IO) metadata update describing all of the host write operations and all of the host read operations on the first set of storage volumes during the capture cycle; transmitting the remote data replication update and the host IO metadata update at the end of the capture cycle to the remote storage array; receiving the remote data replication update and the host IO metadata update during a receive cycle at the remote storage array; temporarily storing the remote data replication update without applying any of the host write operations contained in the remote data replication update to the second set of storage volumes; and while temporarily storing the remote data replication update, performing ransomware anomaly detection using the remote data replication update and the host IO metadata update to determine when any of the host write operations are likely associated with ransomware activity; in response to a determination that one or more of the host write operations is likely associated with ransomware activity, protecting the data contained in the second set of storage volumes; and in response to a determination that none of the host write operations are likely associated with ransomware activity, applying the host write operations contained in the remote data replication update to the second set of storage volumes.
|
