US 12,093,386 B2
Ransomware detection and data pruning management
PurnaChandra Sekhar Bedhapudi, Eatontown, NJ (US); Sri Karthik Bhagi, Morganville, NJ (US); Deepak Raghunath Attarde, Marlboro, NJ (US); Arun Prasad Amarendran, Manalapan, NJ (US); Amit Bhaskar Ausarkar, Ocean, NJ (US); and Mrityunjay Upadhyay, Hyderabad (IN)
Assigned to Commvault Systems, Inc., Tinton Falls, NJ (US)
Filed by Commvault Systems, Inc., Tinton Falls, NJ (US)
Filed on Feb. 11, 2021, as Appl. No. 17/173,816.
Application 17/173,816 is a continuation of application No. 16/129,623, filed on Sep. 12, 2018, abandoned.
Claims priority of provisional application 62/558,752, filed on Sep. 14, 2017.
Prior Publication US 2021/0271758 A1, Sep. 2, 2021
Int. Cl. G06F 21/56 (2013.01); G06F 16/17 (2019.01); G06F 16/174 (2019.01)
CPC G06F 21/566 (2013.01) [G06F 16/1734 (2019.01); G06F 16/1752 (2019.01); G06F 2221/034 (2013.01); G06F 2221/2101 (2013.01)] 19 Claims
OG exemplary drawing
 
1. A computer-implemented method for detecting file activity anomalies, the method comprising:
monitoring, with a filter driver, file system operations performed on primary data by a client computing device;
performing at least a first data protection operation that copies at least a portion of the primary data associated with the client computing device to one or more secondary storage devices as part of secondary data associated with the client computing device;
removing, at a first time, at least some of the secondary data stored in the one or more secondary storage devices according to a secondary data retention policy associated with the client computing device;
detecting, at a second time subsequent to the first time and prior to a second data protection operation, a file activity anomaly based at least on one or more first file system operations of the file system operations performed on the primary data that satisfy one or more threshold conditions associated with the client computing device;
determining, based at least on second file system operations performed on primary data associated with multiple client computing devices, that the detection of the file activity anomaly does not qualify as an actual file activity anomaly; and
wherein determining that the detection of the file activity anomaly does not qualify as an actual file activity anomaly overrides the detection of the file activity anomaly made at the second time.