Method and device for recovering file system

Abstract

To restore a file system, activity of ransomware in a master file system is detected that uses a file system level continuous data protection (CDP) system that logs all file operations for backing up the master file system to a backup memory. Further, ransomware activity is blocked by rejecting new input and output, and the last explicit point in time (PIT) and one or more files infected by the ransomware prior to the ransomware activity are determined. For each of the files, an uninfected version is obtained, an operation is selected from log files of the CDP system that is not associated with the detected ransomware activity, the operation being recorded for the uninfected version of the file after the last explicit PIT, and the selected operation is associated with the detected ransomware activity. And applying only the selected operation to the uninfected version of the file for recovery of the file.

Description

Technical Field

[0001] The present disclosure generally relates to the field of data security, and more particularly to methods and apparatuses for recovering a file system. Background Art

[0002] Ransomware is a prominent cyber threat to both individuals and organizations in terms of data security. Generally, ransomware corresponds to a type of malware that installs itself in a computing system and then maps files that appear important to the user. Thereafter, the ransomware creates an encrypted copy of the target file and deletes the original version of the target file. Finally, the ransomware issues a ransom note, which appears in the target file at the same location or pops up on the user's screen. In addition, the ransom note includes instructions on the process of paying a ransom (e.g., in cryptocurrency) to access the original data of the target file. After paying the ransom, the user receives a decryption key that enables the user to recover the original data of the target file. However, in some cases, the user does not receive the decryption key even after paying the ransom, and thus the data is lost forever. Therefore, such ransomware attacks can result in significant economic losses in the form of ransom, downtime, and data loss.

[0003] Currently, certain attempts have been made to reduce the risk of ransomware, such as protecting email gateways or web gateways through targeted attack protection, or by using mobile attack protection products or by monitoring servers in order to reduce the risk of ransomware attacks during their initialization phase. However, such attempts are inefficient and ineffective in completely reducing the risk of ransomware. Therefore, when ransomware attacks a computing system, the recovery of data plays a crucial role in overcoming the adverse effects of ransomware. In addition, the data affected by a ransomware attack is encrypted, and in order to recover the data, the data needs to be decrypted. However, when decrypting the data, there are certain scenarios in which the original data is lost and data recovery becomes impossible, which is undesirable. In addition, since recovering the original data requires complex operations, these attempts are very time-consuming and resource-consuming, and these attempts are still ineffective in completely recovering the original data. Therefore, there is a technical problem of how to recover data more efficiently and effectively, and to improve the processing time required for completely recovering the file system.

[0004] Therefore, based on the above discussion, it is necessary to overcome the above disadvantages associated with traditional data security methods. Summary of the Invention

[0005] The present disclosure provides methods and apparatuses for restoring a file system. The present disclosure provides a solution to an existing problem, namely how to more efficiently and effectively restore data and improve the processing time required to fully restore a file system. The object of the present disclosure is to provide a solution that at least partially overcomes the problems encountered in the prior art and provides an improved method and an improved apparatus for restoring a file system, for example by using real-time file system ransomware recovery, which real-time file system ransomware recovery utilizes intelligent file system continuous data protection (CDP).

[0006] One or more objects of the present disclosure are achieved by the solutions provided in the appended independent claims. Advantageous implementations of the present disclosure are further defined in the dependent claims.

[0007] In one aspect, the present disclosure provides a method for restoring a file system. The method includes: detecting the activity of ransomware in a primary file system, the primary file system using a file system-level continuous data protection (CDP) system that logs all file operations used to back up the primary file system to a backup storage; blocking the ransomware activity by denying new input / output (IO) associated with the detected ransomware activity; and determining a last clear point in time (PIT) before the ransomware activity occurred. Additionally, the method includes: determining one or more files in the primary file system that have been infected by ransomware; for each infected file among the infected files, obtaining an uninfected version of the file. Additionally, the method includes: selecting, from the log file of the file system-level CDP system, operations that are not associated with the detected ransomware activity and that were recorded for the uninfected version of the file after the last clear PIT; and for each infected file among the infected files, applying the selected operations to the uninfected version of the file.

[0008] The method is for restoring a file system from ransomware activity, for example by identifying potential malware attacks and by alerting for detected ransomware attacks. The method provides efficient data recovery while reducing the processing time, for example by restoring all infected files affected by the ransomware activity. Additionally, the method is for monitoring and tracking parameters of the ransomware activity. Thus, prior knowledge of the parameters of the ransomware activity provides improved and immediate detection of the ransomware activity. Additionally, the method is for utilizing the capabilities of the file system-level CDP system to track the complete life cycle of each file, for example from creation to all other changes made to the file.

[0009] In an implementation form, obtaining an uninfected version of a file includes: obtaining the version of the file at the last explicit PIT from the backup data of the main file system.

[0010] In this implementation manner, for each infected file among the infected files, the uninfected version of the file allows for the efficient recovery of the infected file while reducing the processing time.

[0011] In another implementation form, the selected operations are applied by a replayer device of the file system-level CDP system.

[0012] By replaying the selected operations, the main file system can roll back the changes executed by the ransomware activity.

[0013] In another implementation form, selecting operations from the log file of the file system-level CDP system includes: determining whether the operations in the log file of the file system-level CDP system are associated with the detected ransomware activity based on the activity pattern of the ransomware.

[0014] In another implementation form, selecting operations from the log file of the file system-level CDP system includes: if a file deletion operation is created by the ransomware, determining that the file deletion operation is associated with the detected ransomware activity. Additionally, if a data write operation includes writing encrypted data, determining that the data write operation is associated with the detected ransomware activity. Additionally, the method includes: if a file creation operation includes creating an encrypted copy of the file, determining that the file creation operation is associated with the detected ransomware activity.

[0015] Selecting operations associated with the ransomware activity allows for the selective application of main file system operations and further allows for ignoring all operations associated with the ransomware activity to eliminate the adverse effects of the ransomware activity.

[0016] In another implementation form, the main file system resides in the main memory, and the method further includes returning the recovered file from the backup storage to the main memory.

[0017] By returning the recovered file from the backup storage to the main memory, it is possible to eliminate the adverse effects of the ransomware activity, such as data loss, financial loss in the form of ransom, etc.

[0018] On the other hand, a device for recovering a file system is provided. The device includes a main file system controller configured to: detect the activity of ransomware in the main file system, where the main file system uses a file system-level continuous data protection (CDP) system that logs file operations for backing up the main file system to a backup storage, block the ransomware activity by rejecting new input / output (IO) related to the detected ransomware activity, and identify one or more files in the main file system infected by the ransomware. In addition, a backup controller is configured to: determine the last known point in time (PIT) before the ransomware activity occurred, and for each infected file among the infected files, obtain an uninfected version of the file. Further, for each infected file among the infected files, select an operation from the log file of the file system-level CDP system that is not associated with the detected ransomware activity and that was logged for the uninfected version of the file after the last known PIT, and then apply the selected operation to the uninfected version of the file.

[0019] The device realizes all the advantages and technical effects of the method of the present disclosure.

[0020] It should be understood that all the above implementation forms can be combined.

[0021] It should be noted that all devices, elements, circuitry, units, and apparatuses described in this application can be implemented in software or hardware elements or any combination thereof. All steps performed by the various entities described in this application and the functions described to be performed by the various entities are intended to mean that the corresponding entities are adapted or configured to perform the corresponding steps and functions. Although in the description of the following specific embodiments, the specific functions or steps to be performed by an external entity are not reflected in the description of the specific detailed elements of the entity performing the specific step or function, those skilled in the art should clearly understand that these methods and functions can be implemented in the corresponding software or hardware elements or any combination thereof. It should be understood that the features of the present disclosure are readily combinable in various combinations without departing from the scope of the present disclosure defined by the appended claims.

[0022] Additional aspects, advantages, features, and objectives of the present disclosure will become apparent from the following detailed description of illustrative implementations taken in conjunction with the accompanying drawings and the appended claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The above - described inventive concept and the following detailed description of the illustrative embodiments can be better understood when read in conjunction with the accompanying drawings. To illustrate the present disclosure, exemplary configurations of the present disclosure are shown in the drawings. However, the present disclosure is not limited to the specific methods and means disclosed herein. Moreover, those skilled in the art should understand that the drawings are not drawn to scale. Whenever possible, the same reference numerals are used to denote the same elements.

[0024] Referring to the following drawings, embodiments of the present disclosure are described by way of example only, in which:

[0025] Figure 1 is a flowchart of a method for restoring a file system according to an embodiment of the present disclosure;

[0026] Figure 2 is a block diagram of an apparatus for restoring a file system according to an embodiment of the present disclosure; and

[0027] Figure 3 is a diagram depicting an exemplary scenario for restoring a file system according to an embodiment of the present disclosure.

[0028] In the drawings, underlined reference numerals are used to denote the item in which the underlined reference numeral is located or an item adjacent to the underlined reference numeral. Non - underlined reference numerals are related to the item identified by the line associating the non - underlined reference numeral with the item. When a reference numeral is non - underlined and accompanied by an associated arrow, the non - underlined reference numeral is used to identify the general item to which the arrow points. Detailed Description of the Embodiments

[0029] The following detailed description illustrates embodiments of the present disclosure and ways in which these embodiments can be implemented. Although some modes of implementing the present disclosure have been disclosed, those skilled in the art should recognize that other embodiments for implementing or practicing the present disclosure are also possible.

[0030] Figure 1 is a flowchart of a method for restoring a file system according to an embodiment of the present disclosure. Referring to Figure 1 , a flowchart of method 100 including steps 102 to 114 is shown.

[0031] A method 100 for restoring a file system is provided. Method 100 is used to restore a file system from a ransomware attack, for example, by using real - time file system ransomware recovery, which utilizes an intelligent file - system - level continuous data protection (CDP) system.

[0032] In step 102, method 100 includes: detecting the activity of ransomware in a primary file system that uses a file system-level continuous data protection (CDP) system, where the file system-level CDP system logs all file operations used to back up the primary file system to a backup storage. In an implementation, a primary file system controller is used to detect the activity of ransomware, which corresponds to the execution of computer executable code designed to corrupt data or prevent a user from accessing data, such as by self-installing in a computing system and further encrypting user data stored in the primary file system. Additionally, the primary system uses the file system-level CDP system by logging all file operations such as write operations, delete operations, link operations, unlink operations, copy file ranges, rename operations, etc., to back up the primary file system to a backup storage.

[0033] Furthermore, in step 104, method 100 includes: blocking ransomware activity by denying new input / output (IO) associated with the detected ransomware activity. In other words, new IOs detected as malicious software IOs will be blocked, such as by an agent on the host that detects the process responsible for creating the new IO. For example, if the IO associated with the detected ransomware activity is a "create" operation and an encrypted copy of an existing file is created after the execution of the "create" operation, then in this case, the "create" operation will be blocked. Thus, blocking new IOs prevents any further damage to the primary file system by the ransomware activity.

[0034] In step 106, method 100 includes: determining the last clear point in time (PIT) before the ransomware activity occurs. In an implementation, a backup controller (or CDP engine) is used to determine the last clear PIT before the ransomware activity occurs, for example, by analyzing the backup data of the primary file system in the backup storage. The last clear PIT is used to detect the PIT after which the ransomware activity starts. Therefore, the operations performed after determining the last clear PIT can be ignored to eliminate the adverse effects of the ransomware activity. According to an embodiment, determining the last clear PIT includes: analyzing the backup data of the primary file system in the backup storage, the backup data including one or more snapshots of the primary file system on the backup storage, change sets and change set indexes related to one or more snapshots in the log file of the file system-level CDP system on the backup storage. In an example, if a ransomware activity is detected and the primary file system missed the operations of the ransomware activity before the detection, method 100 includes: restarting the rollback of the backup data from the last clear PIT before the start of the ransomware activity; and updating the primary file system controller with the parameters of the detected ransomware activity to block all operations of the ransomware activity.

[0035] In step 108, method 100 includes: determining one or more files in the primary file system infected by the ransomware. Additionally, based on the analysis of the backup data of the primary file system in the backup storage, which includes one or more files deleted by the ransomware, e.g., through new I / O, one or more files infected by the ransomware activity are determined. Further, in step 110, method 100 includes: for each infected file among the infected files, obtaining an uninfected version of the file. For each infected file among the infected files, the uninfected version of the file corresponds to a version of the file that is not affected by the ransomware activity. According to an embodiment, obtaining the uninfected version of the file includes: obtaining the version of the file at the last clear PIT from the backup data of the primary file system. In an implementation, the backup controller is used to obtain the uninfected version of the file from the determined last clear PIT before the ransomware activity occurs. Therefore, for each infected file among the infected files, the uninfected version of the file allows for the recovery of the infected file, e.g., through the last clear PIT, while reducing the time. Additionally, in step 112, method 100 includes: selecting operations recorded in the log file of the file system-level CDP system that are not associated with the detected ransomware activity and are for the uninfected version of the file after the last clear PIT. Selecting operations not associated with the detected ransomware activity facilitates the recovery of the updated version of the infected file.

[0036] According to an embodiment, selecting operations from the log file of the file system-level CDP system includes: determining whether the operations in the log file of the file system-level CDP system are associated with the detected ransomware activity based on the activity pattern of the ransomware. The method 100 provides continuous data protection by detecting ransomware activity in the main file system, for example, by updating the ransomware detection device with data on the detected ransomware activity. In addition, the data on the detected ransomware activity includes the parameters and / or activity patterns of the detected ransomware activity. For example, a file with a specific suffix is encrypted, and the suffix of the file is further converted to a random suffix. In such an embodiment, the method 100 further includes: determining that the file deletion operation is associated with the detected ransomware activity if the file deletion operation is created by the ransomware. In an implementation scenario, if the operation from the log file of the file system-level CDP system is a file deletion operation associated with the detected ransomware activity, in such a case, the file is not deleted and is marked as a suspicious deletion. In addition, the method 100 includes: determining that the data write operation is associated with the detected ransomware activity if the data write operation includes writing encrypted data. In an implementation scenario, if the operation from the log file of the file system-level CDP system is a data write operation associated with the detected ransomware activity and includes the encryption of data, in such a case, the corresponding data write operation is ignored, and further operations are applied. In addition, the method 100 includes: determining that the file creation operation is associated with the detected ransomware activity if the file creation operation includes creating an encrypted copy of the file. In an implementation scenario, if the operation from the log file of the file system-level CDP system is a file creation operation associated with the detected ransomware activity and includes the encryption of data, in such a case, the corresponding file creation operation is blocked and the data write operation corresponding to the file is further ignored. Therefore, the method 100 allows selective application of main file system operations and also allows ignoring all operations associated with ransomware activity to eliminate the adverse effects of ransomware activity.

[0037] In step 114, method 100 includes applying a selected operation to an uninfected version of a file. An operation not associated with the detected ransomware activity is selected to update the uninfected version of each of these files after the last explicit PIT and obtain a final updated version of the file. Thus, method 100 allows for efficient recovery of infected files while reducing processing time. According to an embodiment, the selected operation is applied by a replacer device of a file system-level CDP system. In an implementation, an online ransomware detection tool is integrated with the file system-level CDP replacer, which applies file system-level CDP system operations to a copy file system to recover infected files, e.g., by replaying the selected operation. Thus, by replaying the selected operation, the main file system can roll back the changes performed by the ransomware activity.

[0038] In the example, the main file system includes three files, e.g., a first file (e.g., the "A.txt" file), a second file (e.g., the "B.text" file), and a third file (e.g., the "C.txt" file). Additionally, the operations performed on the main file system are as follows:

[0039] 1. A read operation on the first file (i.e., the "read A.txt" operation).

[0040] 2. A write operation on the first file (i.e., the "write A.Enc" operation).

[0041] 3. A write operation on the second file (i.e., the "write to B.txt" operation).

[0042] 4. A delete operation on the first file (i.e., the "delete A.enc" operation).

[0043] 5. A write operation on the third file (i.e., the "write to C.txt" operation).

[0044] 6. A read operation on the second file (i.e., the "read B.txt" operation).

[0045] 7. A write operation on the second file (i.e., the "write B.enc" operation).

[0046] 8. A delete operation on the second file (i.e., the "delete B.txt" operation).

[0047] 9. A read operation on the third file (i.e., the "read C.txt" operation).

[0048] 10. A write operation on the third file (i.e., the "write C.enc" operation).

[0049] 11. The deletion operation of the third file (i.e., the "deleted C.txt" operation).

[0050] In the above example, the operations with the ".enc" suffix are determined to be operations associated with ransomware activities. Thus, by using the replayer device, the operations with the "enc." suffix are ignored, and write operations are applied, such as the operation of writing to the second file (i.e., the "write B.txt" operation) and the operation of writing to the third file (i.e., the "write C.txt" operation). Thus, by eliminating the adverse effects of ransomware activities, the infected files, such as the second file and the third file, are restored.

[0051] According to an embodiment, the main file system resides on the main memory. In addition, method 100 further includes returning the restored files from the backup memory to the main memory. Thus, the adverse effects of ransomware activities, such as data loss, loss of money in the form of ransom, etc., are eliminated. According to an embodiment, the backup memory resides in a network-attached storage (NAS), and the NAS includes one or more snapshots of the main file system and the log files of the file system-level CDP system. In addition, the restoration of the infected files includes manipulating the metadata of the infected files within the NAS. In an implementation scenario, if the log files of the file system-level CDP system and the snapshots of the main file system are in the same storage pool in the NAS system, then in this case, the restoration of the infected files is performed by manipulating the metadata of the infected files in the NAS. In addition, the restoration of the infected files does not require copying data from the main file system, which reduces the processing time required to restore the infected files.

[0052] Method 100 is used to restore a file system from ransomware activities, for example, by identifying potential malware attacks and issuing an alert for detected ransomware attacks. Method 100 provides efficient data restoration while reducing the processing time, for example, by restoring all infected files affected by ransomware activities. In addition, method 100 is used to monitor and track the parameters of ransomware activities. Thus, prior knowledge of the parameters of ransomware activities provides improved and immediate detection of future ransomware activities. In addition, method 100 is used to utilize the capabilities of the file system-level CDP system to track the complete life cycle of each file, such as from creation to all other changes performed on the file.

[0053] Steps 102 to 114 are merely illustrative, and other alternatives may be provided without departing from the scope of the claims herein. In the other alternatives, one or more steps may be added, one or more steps may be deleted, or one or more steps may be provided in a different order.

[0054] Figure 2 is a block diagram of an apparatus for restoring a file system according to an embodiment of the present disclosure. Referring to Figure 2 , an apparatus 202 including a main file system controller 204 and a backup controller 212 is shown. The apparatus 202 is configured to execute Figure 1 method 100.

[0055] The main file system controller 204 is configured to detect the activity of ransomware in the main file system 206. Examples of the main file system controller 204 may include, but are not limited to, a general-purpose processor, a controller, a microcontroller, a microprocessor, a complex instruction set computing (CISC) processor, an application-specific integrated circuit (ASIC) processor, a reduced instruction set computing (RISC) processor, a very long instruction word (VLIW) processor, a data processing unit, and other processors or control circuitry.

[0056] The backup controller 212 is configured to block ransomware activity. Examples of the backup controller 212 may include, but are not limited to, a general-purpose processor, a controller, a microcontroller, a microprocessor, a CISC processor, an ASIC processor, a RISC processor, a VLIW processor, a data processing unit, and other processors or control circuitry.

[0057] An apparatus 202 for restoring a file system from a ransomware attack is provided, for example, by using real-time file system ransomware recovery, which utilizes an intelligent file system-level CDP system.

[0058] In operation, the primary file system controller 204 is configured to detect the activity of ransomware in the primary file system 206. Additionally, the primary file system 206 uses a file system-level CDP system 208 that logs file operations for backing up the primary file system 206 to a backup storage 210. The activity of ransomware corresponds to the execution of computer-executable code that is designed to corrupt data or prevent a user from accessing data, such as by installing itself in the computing system and further encrypting user data stored in the primary file system 206. Further, the primary file system 206 uses the file system-level CDP system 208 (or may also be referred to as the CDP system 208) by logging all file operations such as write operations, delete operations, link operations, unlink operations, copy file ranges, rename operations, etc. to back up the primary file system 206 to the backup storage 210.

[0059] The main file system controller 204 is also configured to block ransomware activities by denying new IOs associated with detected ransomware activities. In other words, new IOs detected as malware IOs will be blocked, for example, by an agent on the host that detects the process responsible for creating the new IO. Additionally, the main file system controller 204 is configured to identify one or more files 222 infected by ransomware in the main file system 206. Further, based on an analysis of the backup data 214 of the main file system 206 in the backup memory 210, one or more files infected by ransomware activities are identified, where the backup memory 210 includes one or more files 222 deleted by ransomware, for example, via new IOs. Additionally, the backup controller 212 is configured to determine an explicit PIT before the occurrence of a ransomware activity. In an implementation, the CDP engine is used to determine the last explicit PIT before the occurrence of a ransomware activity, for example, by analyzing the backup data of the main file system in the backup memory. The last explicit PIT is used to detect the PIT after which the ransomware activity was initiated. Thus, operations performed after the determination of the last explicit PIT can be ignored to eliminate the adverse effects of the ransomware activity. According to an embodiment, the backup controller 212 is configured to determine the last explicit PIT by analyzing the backup data 214 of the main file system 206 in the backup memory 210, where the backup data 214 includes one or more snapshots of the main file system 206 on the backup memory 210, change sets associated with one or more snapshots in the log file 220 of the file system-level CDP system 208 on the backup memory 210, and change set indexes. In an example, if a ransomware activity is detected and the main file system 206 missed the operations performed by the ransomware activity before the detection, the backup controller 212 restarts the rollback of the backup data 214 from the last explicit PIT before the start of the ransomware activity and updates the main file system controller 204 with the parameters of the detected ransomware activity to block all operations of the ransomware activity.

[0060] In addition, the backup controller 212 is configured to: for each infected file among the infected files, obtain an uninfected version of the file. For each infected file among the infected files, the uninfected version of the file corresponds to the version of the file that is not affected by the ransomware activity. According to an embodiment, the backup controller 212 is configured to: obtain the uninfected version of the file by obtaining the version of the file at the last explicit PIT from the backup data 214 of the primary file system 206. Thus, for each infected file among the infected files, the uninfected version of the file allows for a more efficient recovery of the infected file, such as through the last explicit PIT, while reducing the processing time. In addition, the backup controller 212 is configured to: select an operation from the log file 220 of the file system-level CDP system 208 that is not associated with the detected ransomware activity and that was recorded for the uninfected version of the file after the last explicit PIT. Selecting the operation from the log file 220 facilitates the recovery of an updated version of the infected file.

[0061] According to an embodiment, the backup controller 212 is configured to determine whether an operation in the log file 220 of the file system-level CDP system 208 is associated with the detected ransomware activity based on the activity pattern of the ransomware. The apparatus 202 provides continuous data protection by detecting ransomware activity in the main file system 206, for example, by updating the ransomware detection device with data on the detected ransomware activity. In addition, the data on the detected ransomware activity includes parameters and / or activity patterns of the detected ransomware activity. In such an embodiment, the backup controller 212 is configured to determine that a file deletion operation is associated with the detected ransomware activity if the file deletion operation is created by the ransomware. In an implementation scenario, if an operation from the log file of the file system-level CDP system is a file deletion operation associated with the detected ransomware activity, then in such a case, the file is not deleted and is marked as a suspected deletion. In addition, the backup controller 212 is configured to determine that a data write operation is associated with the detected ransomware activity if the data write operation includes writing encrypted data. In an implementation scenario, if an operation from the log file of the file system-level CDP system is a data write operation associated with the detected ransomware activity and includes encryption of the data, then in such a case, the corresponding data write operation is ignored and further operations are applied. In addition, the backup controller 212 is configured to determine that a file creation operation is associated with the detected ransomware activity if the file creation operation includes creating an encrypted copy of the file. In an implementation scenario, if an operation from the log file of the file system-level CDP system is a file creation operation associated with the detected ransomware activity and includes encryption of the data, then in such a case, the corresponding file creation operation is blocked and the data write operation corresponding to the file is further ignored. Thus, the backup controller 212 is configured to selectively apply operations on the main file system 206 and ignore all operations associated with the ransomware activity to eliminate the adverse effects of the ransomware activity.

[0062] The backup controller 212 is configured to apply selected operations to the uninfected version of the file. Thus, the backup controller 212 is configured to selectively apply operations on the main file system 206 to ignore all operations associated with the ransomware activity in order to eliminate the adverse effects of the ransomware activity. According to an embodiment, the backup controller 212 is configured to use the replayer device of the file system-level CDP system 208 to apply the selected operations. By replaying the selected operations, the main file system 206 can roll back changes made after the ransomware activity is detected.

[0063] According to an embodiment, the main file system 206 resides on the main memory 216, and the main file system controller 204 is configured to return the restored files from the backup memory 210 to the main memory 216. Accordingly, the adverse effects of ransomware activities, such as data loss, loss of money in the form of ransom, etc., are eliminated. According to an embodiment, the backup memory 210 resides in a network-attached storage (NAS) 218, and the NAS 218 includes one or more snapshots of the main file system 206 and the log files 220 of the file system-level CDP system 208. In addition, the backup controller 212 is configured to apply a selected operation by manipulating the metadata of the infected files within the NAS 218. In an implementation scenario, if the log files of the file system-level CDP system and the snapshots of the main file system are in the same storage pool in the NAS system, in this case, the recovery of the infected files is performed by manipulating the metadata of the infected files in the NAS. In addition, the recovery of the infected files does not require copying data from the main file system, which reduces the processing time required to recover the infected files.

[0064] The apparatus 202 is used to recover a file system from ransomware activities, for example, by identifying potential malware attacks and alerting for detected ransomware attacks. The apparatus 202 provides efficient data recovery while reducing the processing time, for example, by recovering all the infected files affected by ransomware activities. In addition, the main file system 206 is used to monitor and track the parameters of ransomware activities. Accordingly, the prior knowledge of the parameters of ransomware activities provides improved and immediate detection against ransomware activities. In addition, the apparatus 202 is used to utilize the capabilities of the file system-level CDP system 208 to track the complete life cycle of each file, for example, from creation to all other changes performed on the file.

[0065] Figure 3 is a diagram depicting an exemplary scenario for recovering a file system according to an embodiment of the present disclosure. In conjunction with Figure 2 the description of the elements Figure 3 . Referring to Figure 3 , a production host 302 and a NAS system 304 are shown.

[0066] In an exemplary scenario, the production host 302 is configured to write to the main file system 30 included in the NAS system 304. In an implementation, the NAS system 304 includes a built-in file system-level CDP system (e.g., Figure 2) which includes the CDP log 306. Additionally, the CDP log 306 includes all changes related to the main file system 308 and also includes one or more snapshots of the main file system 308, for example, in order to utilize the one or more snapshots. The CDP log 306 allows the main file system 308 to roll back and eliminate the adverse effects of ransomware activities.

[0067] In an implementation, if ransomware activity is detected, then Figure 2 the device 202 is configured to determine the relevant infected files from the main file system 308. For example, if it is found that the file F1 stored in the main file system 308 is infected, then ( Figure 2 of) the device 202 is configured to roll back the changes and eliminate the adverse effects of ransomware activities. Additionally, the backup controller 212 is configured to: determine the uninfected version of each of the infected files and determine the last clear PIT, for example, by analyzing the backup data 214 of the main file system 308 stored in the backup memory 210. Additionally, the backup memory 210 resides in the NAS system 304, and the NAS system 304 includes one or more snapshots of the main file system 206, such as the first snapshot 308A and the Kth snapshot 308K. Additionally, the backup controller 212 is configured to: by analyzing one or more snapshots of the main file system 308, for example, by analyzing the first snapshot 308A to the Kth snapshot 308K on the NAS system 304, by analyzing the change sets and change set indexes related to one or more snapshots in the Figure 2 log file 220 of the Figure 2 file system-level CDP system 208 ( Figure 2 of) to determine the last clear PIT. Additionally, the main file system 308 allows consecutive snapshots, for example, from the first snapshot 308A to the Kth snapshot 308K, which enables the device 202 to utilize the detection of ransomware activities by the CDP log 306 to recover the uninfected version of each of the infected files from the last clear PIT. Additionally, the backup controller 212 (

[0068] Modifications may be made to the embodiments of the present disclosure described above without departing from the scope of the present disclosure as defined by the appended claims. Expressions such as "including", "comprising", "incorporating", "have", "is" used to describe and claim the present disclosure are intended to be interpreted in a non-exclusive manner, i.e., to allow the presence of items, components or elements not expressly described. References to the singular should also be construed as referring to the plural. The term "exemplary" is used herein to mean "serving as an example, instance, or illustration". Any embodiment described as "exemplary" is not necessarily to be construed as more preferred or advantageous than other embodiments or to exclude combinations of features of other embodiments. The term "optionally" is used herein to mean "provided in some embodiments and not provided in other embodiments". It should be understood that certain features of the present disclosure described in the context of separate embodiments may also be provided in combination in a single embodiment. Conversely, the various features of the present invention described in the context of a single embodiment for brevity may also be provided separately or in any suitable combination, or in any other described embodiment suitable for the present disclosure.

Claims

1. A method (100) for recovering a file system, comprising: Detecting the activity of ransomware in a primary file system (206), the primary file system (206) using a file system-level continuous data protection CDP system (208), the file system-level CDP system (208) logging all file operations for backing up the primary file system (206) to a backup memory (210); Blocking the ransomware activity by rejecting new input / output IOs associated with the detected ransomware activity; Determining a last known point-in-time PIT before the ransomware activity occurred; Determining one or more files in the primary file system (206) that have been infected by the ransomware; For each infected file among the infected files: Obtaining an uninfected version of the file; Selecting, from a log file (220) of the CDP system (208), operations not associated with the detected ransomware activity, the operations being recorded for the uninfected version of the file after the last known PIT; and Applying the selected operations to the uninfected version of the file.

2. The method (100) according to claim 1, wherein Obtaining the uninfected version of the file includes: obtaining the version of the file at the last known PIT from backup data (214) of the primary file system (206).

3. The method (100) according to claim 1 or 2, wherein Determining the last known PIT includes analyzing backup data (214) of the primary file system (206) in the backup memory (210), the backup data (214) including one or more snapshots of the primary file system (206) on the backup memory (210), change sets associated with the one or more snapshots in a log file (220) of the CDP system (208) on the backup memory (210), and a change set index.

4. The method (100) according to any one of claims 1 to 3, wherein, The selected operations are applied by a replayer device of the CDP system (208).

5. The method (100) according to any one of claims 1 to 4, wherein, Selecting operations from the log file (220) of the CDP system (208) includes: Determining whether an operation in the log file (220) of the CDP system (208) is associated with the detected ransomware activity based on the activity pattern of the ransomware.

6. The method (100) according to any one of claims 1 to 5, wherein, Selecting operations from the log file (220) of the CDP system (208) includes: Determining that a file deletion operation is associated with the detected ransomware activity if the file deletion operation was created by the ransomware; Determining that a data write operation is associated with the detected ransomware activity if the data write operation includes writing encrypted data; and Determining that a file creation operation is associated with the detected ransomware activity if the file creation operation includes creating an encrypted copy of a file.

7. The method (100) according to any one of claims 1 to 6, wherein The primary file system (206) resides on a main memory (216), and the method (100) further includes returning the recovered files from the backup memory (210) to the main memory (216).

8. The method (100) according to any one of claims 1 to 7, wherein The backup memory (210) resides in a Network Attached Storage (NAS) (218), and the NAS (218) includes a snapshot of the main file system (206) and the log file (220) of the CDP system (208). Recovering the infected file includes manipulating the metadata of the infected file within the NAS (218).

9. A device (202) for recovering a file system, comprising: A main file system controller (204), the main file system controller (204) being configured to: Detect the activity of ransomware in the main file system (206), wherein the main file system (206) uses a file system-level Continuous Data Protection (CDP) system (208), and the file system-level CDP system (208) logs file operations for backing up the main file system (206) to the backup memory (210). Block the ransomware activity by rejecting new Input / Output (IO) associated with the detected ransomware activity, and Determine one or more files (222) infected by the ransomware in the main file system (206), and A backup controller (212), the backup controller (212) being configured to: Determine the last Point-in-Time (PIT) before the occurrence of the ransomware activity, and For each infected file among the infected files: Obtain the uninfected version of the file, Select operations from the log file (220) of the CDP system (208) that are not associated with the detected ransomware activity, and the operations are recorded for the uninfected version of the file after the last clear PIT, Apply the selected operations to the uninfected version of the file.

10. The apparatus (202) according to claim 9, wherein, The backup controller (212) is configured to: obtain the uninfected version of the file by obtaining the version of the file at the last clear PIT from the backup data (214) of the main file system (206).

11. The apparatus (202) according to claim 9 or 10, wherein, The backup controller (212) is configured to determine the last clear PIT by analyzing the backup data (214) of the main file system (206) in the backup memory (210), and the backup data (214) includes one or more snapshots of the main file system (206) on the backup memory (210), a change set and a change set index related to the one or more snapshots in the log file of the file system-level CDP system (208) on the backup memory (210).

12. The apparatus (202) according to any one of claims 9 to 11, wherein, The backup controller (212) is configured to: apply the selected operations using a replayer device of the CDP system.

13. The apparatus (202) according to any one of claims 9 to 12, wherein The backup controller (212) is configured to: determine whether the operations in the log file (220) of the CDP system are associated with the detected ransomware activity based on the activity pattern of the ransomware.

14. The apparatus (202) according to claim 13, wherein, The backup controller (212) is configured to: If the file deletion operation is created by the ransomware, determine that the file deletion operation is associated with the detected ransomware activity, If the data write operation includes writing encrypted data, determine that the data write operation is associated with the detected ransomware activity, and If the file creation operation includes creating an encrypted copy of a file, determine that the file creation operation is associated with the detected ransomware activity.

15. The apparatus (202) according to any one of claims 9 to 14, wherein, The main file system (206) resides on the main memory (216), and the main file system controller (204) is configured to return the restored file from the backup memory (210) to the main memory (216).

16. The apparatus (202) according to any one of claims 9 to 15, wherein, The backup memory (210) resides in a network-attached storage NAS (218), the NAS (218) includes a snapshot of the main file system (206) and a log file (220) of the file system-level CDP system (208), and the backup controller is configured to apply the selected operation by manipulating the metadata of the infected file within the NAS (218).

Images