US 11,983,270 B2
Malicious software detection
Prashant Gaurav, Fremont, CA (US); Sidharth Mishra, Santa Clara, CA (US); Karandeep Singh Chawla, Santa Clara, CA (US); Anubhav Gupta, Sunnyvale, CA (US); Sudhir Srinivas, Cary, NC (US); Apurv Gupta, Bangalore (IN); and Nagapramod Mandagere, Mountain View, CA (US)
Assigned to Cohesity, Inc., San Jose, CA (US)
Filed by Cohesity, Inc., San Jose, CA (US)
Filed on Jan. 22, 2021, as Appl. No. 17/156,050.
Application 17/156,050 is a continuation of application No. 16/832,503, filed on Mar. 27, 2020, granted, now 10,943,011.
Application 16/832,503 is a continuation of application No. 16/372,230, filed on Apr. 1, 2019, granted, now 10,650,146, issued on May 12, 2020.
Claims priority of provisional application 62/778,669, filed on Dec. 12, 2018.
Prior Publication US 2021/0240828 A1, Aug. 5, 2021
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/56 (2013.01); G06F 16/23 (2019.01)
CPC G06F 21/565 (2013.01) [G06F 16/2365 (2019.01)] 19 Claims
OG exemplary drawing
 
1. A method, comprising:
determining an amount of deduplication associated with a backup snapshot;
in response to determining that the amount of deduplication associated with the backup snapshot is less than a deduplication threshold, determining a number of files associated with the backup snapshot that were added, deleted, and/or modified;
in response to determining that the number of files associated with the backup snapshot that were added, deleted, and/or modified is greater than a change threshold, determining an amount of entropy associated with changed data included in the backup snapshot, wherein the entropy associated with the changed data is a measure of randomness associated with a file;
in response to determining that the amount of entropy associated with changed data included in the backup snapshot is greater than an entropy threshold, determining that the backup snapshot is potentially infected with malicious software; and
providing to a primary system a notification that the backup snapshot includes data that is potentially infected with malicious software.