Apparatus and method for ransomware detection in backup data with unknown data format

Abstract

The invention relates to a device and a method for ransomware detection in backup data with an unknown data format. The apparatus includes a controller to obtain first backup data and second backup data from an auxiliary storage, where the second backup data is generated in the auxiliary storage later than the first backup data, and where the second backup data has an unknown data format, where the second backup data is generated in the auxiliary storage later than the first backup data. The first backup data has a known data format or an unknown data format; and a processor to detect a ransomware attack on the second backup data based on the one or more parameters of the first backup data and the one or more parameters of the second backup data. The one or more parameters of the first backup data and the one or more parameters of the second backup data indicate at least one of an amount of change, a compression ratio, a deduplication rate, an entropy, or a predefined signature.

Description

Technical Field

[0001] The present invention relates to a device for detecting ransomware in backup data with unknown data format. The present invention also provides a corresponding method for detecting ransomware in backup data with unknown data format, and a computer program product for executing the method. Background Art

[0002] Ransomware is a type of malware that threatens to release data or block access to data or computer systems, usually by encrypting them, until the victim pays the attacker a ransom. In many cases, the ransom demand has a deadline. If the victim does not pay in time, the data is lost forever, or the ransom is increased.

[0003] Ransomware attacks are becoming more common, with some of the largest companies in North America and Europe falling victim to them. Cybercriminals will target any consumer or any business, with victims spanning every industry.

[0004] Ransomware is a type of malware designed to extort money from a victim by preventing them from accessing data on their system. The two most popular types of ransomware are encryptors and screen lockers. Encryptors, as the name implies, encrypt the data on a system, making the contents unusable without a decryption key. Screen lockers, on the other hand, simply block access to a system by "locking" the screen, showing that the system is encrypted.

[0005] For encryptors and screen lockers, victims are often notified on the locked screen to purchase a cryptocurrency, such as Bitcoin, in order to pay a ransom. Once the ransom is paid, the victim receives a decryption key, allowing them to attempt to decrypt the files. However, decryption is not guaranteed, and multiple sources have reported varying degrees of success after paying the ransom. Sometimes victims never receive a decryption key. Some attacks install malware on computer systems even after the ransom is paid and the data is released.

[0006] While initially focused on personal computers, crypto-ransomware has increasingly targeted corporate users, as businesses typically pay more than individuals to unlock critical systems and resume daily operations.

[0007] An enterprise ransomware infection or virus usually starts with a malicious email. An unsuspecting user opens an attachment or clicks on a malicious or compromised URL. At this point, the ransomware agent is installed and begins encrypting critical files on the victim's PC and any attached file shares. After encrypting the data, the ransomware displays a message on the infected device. The message explains what has happened and how to pay the attacker. The ransomware promises that if the victim pays, the victim will be given a code to unlock their data.

[0008] Companies that are victims of ransomware can lose a lot of money due to lost productivity and data. Attackers with access to data blackmail victims by threatening to publish data and expose data breaches in exchange for payment, so organizations that fail to pay in a timely manner may suffer other adverse effects such as brand damage and lawsuits.

[0009] Ransomware can cause production to stall, so if a ransomware infection is detected, the victim's first response should be to get the ransomware under control. After the ransomware is under control, the victim can either restore the data from a data backup or pay the ransom. Root cause analysis helps identify the victim's vulnerability, but any delay in data recovery will affect production and business revenue.

[0010] To prevent ransomware attacks, users can protect their emails from ransomware attacks. Email phishing and spam are the main ways ransomware attacks are spread. Secure email gateways with targeted attack protection are essential to detect and block malicious emails that send ransomware. These solutions can block malicious attachments, malicious documents, and URLs in emails sent to user computers.

[0011] Users can also protect their mobile devices from ransomware attacks. Mobile attack protection products, when used in conjunction with mobile device management (MDM) tools, can analyze applications on user devices and immediately alert users and IT of any applications that could compromise the environment.

[0012] Additionally, protecting users from ransomware attacks is recommended. A secure web gateway can scan users’ web traffic to identify malicious web ads that could lead them to ransomware.

[0013] Users can also monitor their servers, networks, and backup critical systems. Monitoring tools can detect abnormal file access activity, viruses, network command and control (C&C) traffic, and CPU load to prevent ransomware activation in a timely manner. Keeping a complete mirror copy of critical systems can reduce the risk of machine crashes or encryption causing critical operational bottlenecks.

[0014] Like most malware, ransomware is designed to infect a computer and remain undetected until its purpose is accomplished. In the case of ransomware, the attacker's goal is for the victim to only become aware of the infection when they receive a ransom demand.

[0015] Common anti-ransomware solutions aim to identify ransomware infections as early as possible in the infection process, before any damage is done. To this end, many ransomware detection techniques are used to overcome the ransomware's stealth and defense evasion capabilities.

[0016] When it comes to ransomware, early detection is critical because the damage done can be irreversible. If ransomware encrypts data that is not included in secure backups, that data may not be recoverable even if the victim pays the ransom. Therefore, identifying and removing a ransomware infection before encryption begins is key to minimizing its impact.

[0017] As ransomware evolves, early detection becomes even more important. Modern ransomware variants often spread before encrypting a company’s sensitive data. If a ransomware attack can be detected before data theft occurs, companies can avoid data breaches that can be costly and embarrassing.

[0018] Most current ransomware detection techniques are based on internal data formats, so these techniques require prior knowledge of the data to be scanned. Backup applications tend to aggregate multiple files into a collection and then back up the entire collection as a single blob of data. The format of the collection object can be a well-known archive format (e.g., tar, rar, etc.) or a proprietary format that is specific to the backup application.

[0019] As a result, the backup storage system is not always aware of the internal format of the backup copy used by the backup application, which means that the backup looks like a single blob of raw data.

[0020] Ransomware infections can be identified by several different means. Some of the most common ransomware detection mechanisms include:

[0021] (a) Signature detection: Signature-based detection is the simplest way to identify the presence of malware on a system. Malware signatures include information such as file hashes, domain names and IP addresses of command and control infrastructure, and other indicators that can uniquely identify a malware sample. Signature-based detection systems store a library of these signatures and compare them to every file that enters or runs on a system to determine if malware is present. However, this mechanism is increasingly ineffective. Signature-based detection is not practical for new malware because signatures have not yet been created for malware variants. Today, ransomware groups often use unique versions of their malware (with different file hashes, command and control infrastructure, etc.) for each attack campaign, which makes signature-based detection ineffective.

[0022] (b) Behavioral detection: Behavioral-based detection algorithms can be designed to look for specific malicious activities, or to look for unusual, anomalous actions. Behavioral-based ransomware detection takes advantage of the fact that ransomware behavior is unusual. For example, the encryption phase of ransomware requires the malware to open many files on the system, read their contents, and then overwrite those files with encrypted versions. If an anti-ransomware solution monitors file operations or encryption operations and alerts on this unusual behavior, then this behavior can help ransomware detection.

[0023] (c) Abnormal traffic detection: Ransomware can also be detected at the network level by looking for abnormal traffic. Modern ransomware steals and transmits sensitive data before encrypting it, thus providing attackers with additional leverage when persuading victims to pay the ransom.

[0024] Carrying out a large-scale data exfiltration requires the ability to send large amounts of data from inside the network to external systems under the control of the attacker. While ransomware may attempt to hide these data transfers, they can create anomalous network traffic that can be detected and traced back to the presence of ransomware on the system.

[0025] However, for backup data, the latter two techniques are not really useful because during the backup process, users may no longer have the information required by these techniques, such as access patterns, access users, etc. Therefore, the main techniques used for backup data are detection through signatures and regular expressions.

[0026] Traditional schemes require a priori knowledge of the data format because predefined signatures and regular expressions are scanned at special locations inside the file (e.g., file name, file extension, file header, extended attributes, etc.), thus resulting in a low detection rate when trying to detect ransomware in backup data where the data format is unknown. Summary of the invention

[0027] In view of the above situation, the present disclosure aims to improve the traditional scheme for ransomware detection and to provide a device and a corresponding method for detecting ransomware in backup data with unknown data format.

[0028] This object is achieved by what is provided in the attached independent claim. Advantageous implementations are further defined in the dependent claims.

[0029] According to a first aspect, a device for performing ransomware detection in backup data with an unknown data format is provided, comprising: a controller for obtaining first backup data and second backup data from an auxiliary storage, wherein the second backup data is generated in the auxiliary storage later than the first backup data, wherein the second backup data has an unknown data format, and wherein the first backup data has a known data format or an unknown data format; and a processor for detecting a ransomware attack on the second backup data based on one or more parameters of the first backup data and one or more parameters of the second backup data, wherein the one or more parameters of the first backup data indicate at least one of the following: a change amount, a compression ratio, a deduplication rate, an entropy, or a predefined signature; and wherein the one or more parameters of the second backup data indicate at least one of the following: a change amount, a compression ratio, a deduplication rate, an entropy, or a predefined signature.

[0030] The first backup data may include one or more backup data copies, and the one or more backup data copies are generated in the auxiliary storage earlier than the second backup data.

[0031] This provides the advantage that by analyzing the parameters of the first backup data and the parameters of the second backup data, a ransomware attack can be detected in backup data whose data format is unknown. Thus, an improved ransomware detection device is provided.

[0032] In an implementation of the first aspect, the processor is further used to: determine a difference between the first backup data and the second backup data based on one or more parameters of the first backup data and one or more parameters of the second backup data; and when the determined difference exceeds a preset threshold, determine a ransomware attack on the second backup data.

[0033] This offers the advantage that ransomware detection in the second backup data, whose data format is unknown, is faster and can be performed while the backup is being stored.

[0034] For example, determining that the second backup data is attacked by ransomware may mean that the processor is configured to determine that a probability that the second backup data is attacked by ransomware is higher than a preset threshold.

[0035] In an implementation of the first aspect, the processor is further configured to search for one or more metadata tags within the second backup data; wherein the one or more metadata tags include at least one of the following: a file name, a signature, a zero sequence, and a repeating pattern within the second backup data.

[0036] This provides the advantage that even if the second backup data has an unknown data format, relevant data within the second backup data can be identified.

[0037] In an implementation of the first aspect, when one or more metadata markers are detected within the second backup data, the processor is further used to: indicate the start and end of each entry of the second backup data based on the detected one or more metadata markers, wherein each entry includes an object or a file; split the second backup data into separate entries based on the indicated start and end of each entry; and for each entry of the second backup data, determine the corresponding entry in the first backup data.

[0038] This provides an advantage in that the second backup data can be split into separate entries even if the second backup data has an unknown data format.

[0039] In an implementation of the first aspect, the processor is further used to: determine one or more parameters in each entry of the first backup data and one or more parameters in each entry of the second backup data; for each entry, determine a parameter difference based on one or more parameters of the first backup data and one or more parameters of the second backup data; and when the parameter difference exceeds a preset threshold, determine a ransomware attack on the second backup data.

[0040] By enabling ransomware attack detection in each entry of the second backup data, the efficiency of ransomware detection in backup data whose data format is unknown may be improved.

[0041] In an implementation of the first aspect, the processor is further used to: determine the entropy of each file at the file system level between snapshots of the same data body in the first backup data, and the entropy of each file at the file system level between the snapshots of the same data body in the second backup data; for each file at the file system level between the snapshots of the same data body, determine an entropy difference based on the entropy of the first backup data and the entropy of the second backup data; and analyze the entropy difference of each file at the file system level between the snapshots of the same data body, and determine the presence of a ransomware attack on the second backup data based on the analyzed entropy difference.

[0042] For example, analysis may be performed on the entropy differences of each file at the file system level between snapshots of the same data volume using a machine learning algorithm.

[0043] In an implementation of the first aspect, when the metadata tag in the second backup data is not detected, the processor is further used to: identify the file name of each file in the second backup data; split the second backup data into separate files based on the file name of each identified file; for each file of the second backup data, determine the corresponding file in the first backup data; determine one or more parameters of the first backup data in each file of the first backup data, and one or more parameters of the second backup data in each file of the second backup data; for each file, determine a parameter difference based on one or more parameters of the first backup data and one or more parameters of the second backup data, and when the parameter difference of one of the files exceeds a preset threshold, determine a ransomware attack on the second backup data.

[0044] This provides the advantage that the file name can be found in the second backup data even if the second backup data has an unknown data format. Further advantageously, since ransomware detection is performed in each file of the second backup data, the efficiency of ransomware detection in backup data with an unknown data format can be improved.

[0045] In an implementation of the first aspect, when the metadata tag in the second backup data is not detected, the processor is further used to: determine the entropy of the first backup data; determine the amount of change in the second backup data, and determine the entropy of the amount of change in the second backup data; determine an entropy difference based on the entropy of the first backup data and the entropy of the amount of change in the second backup data, and when the entropy difference exceeds a preset threshold, determine a ransomware attack on the second backup data.

[0046] This provides the advantage that ransomware detection in backup data whose data format is unknown can be achieved every time an incremental backup is performed, thereby improving efficiency.

[0047] In an implementation of the first aspect, the processor is further used to: use one or more parameters in each entry of the first backup data and one or more parameters in each entry of the second backup data, or one or more parameters in each file of the first backup data and one or more parameters in each file of the second backup data as input to the ransomware detection algorithm.

[0048] For example, the ransomware detection algorithm may be an existing ransomware detection algorithm for a known data format.

[0049] This can improve the efficiency of ransomware detection because existing ransomware detection algorithms can be used on a per-entry basis even if the entire second backup has an unknown data format.

[0050] In an implementation of the first aspect, when the metadata marker in the second backup data is not detected, the processor is further used to: search for one or more predefined signatures in the second backup data; if one or more predefined signatures are found in the second backup data, determine a ransomware attack on the second backup data.

[0051] This provides the advantage that ransomware in the second backup data can be easily detected by identifying a predefined signature in the original data of the second backup data.

[0052] For example, one or more predefined signatures may be selected by querying a database including mapping relationships between several ransomware and their related signatures.

[0053] In an implementation of the first aspect, the processor is further used to send a warning message to the controller, wherein the warning message includes information alerting a user about a ransomware attack on the second backup data; and the controller is further used to communicate with a production device, wherein the production device is accessible to a user, and the production device is used to display the warning message to the user.

[0054] This provides the advantage of preventing the user from further writing new data that might be vulnerable to theft by ransomware.

[0055] In an implementation manner of the first aspect, the device is implemented inside the auxiliary storage or outside the auxiliary storage, or the device is implemented in an intelligent device located inside the auxiliary storage or outside the auxiliary storage.

[0056] This offers the advantage that the detection time of the backup data can be improved.

[0057] Further advantageously, once ransomware is detected within the second backup data, the controller may lock the first backup data so that the first backup data is not deleted from the secondary storage during the normal process of deleting old backup data.

[0058] In the first aspect and implementation thereof, the described functions may be implemented in hardware, software, firmware or any combination thereof.

[0059] According to a second aspect, a method for performing ransomware detection in backup data with an unknown data format is provided, comprising the following steps: obtaining first backup data and second backup data from an auxiliary storage, wherein the second backup data is generated in the auxiliary storage later than the first backup data, wherein the second backup data has an unknown data format, and wherein the first backup data has a known data format or an unknown data format; and determining a ransomware attack on the second backup data based on one or more parameters of the first backup data and one or more parameters of the second backup data; wherein the one or more parameters of the first backup data indicate at least one of the following: a change amount, a compression ratio, a deduplication rate, an entropy, or a predefined signature; and wherein the one or more parameters of the second backup data indicate at least one of the following: a change amount, a compression ratio, a deduplication rate, an entropy, or a predefined signature.

[0060] The first backup data may include one or more backup data copies, and the one or more backup data copies are generated in the auxiliary storage earlier than the second backup data.

[0061] This provides the advantage that by analyzing the parameters of the first backup data and the parameters of the second backup data, a ransomware attack can be detected in backup data whose data format is unknown. Thus, an improved ransomware detection device is provided.

[0062] In an implementation of the second aspect, the method further includes: determining a difference between the first backup data and the second backup data based on one or more parameters of the first backup data and one or more parameters of the second backup data; and determining a ransomware attack on the second backup data when the determined difference exceeds a preset threshold.

[0063] This offers the advantage that ransomware detection in the second backup data, whose data format is unknown, is faster and can be performed while the backup is being stored.

[0064] Specifically, determining that the second backup data is attacked by ransomware means: determining that a probability that the second backup data is attacked by ransomware is higher than a preset threshold.

[0065] In an implementation of the second aspect, the method further includes: searching for one or more metadata tags within the second backup data; wherein the one or more metadata tags include at least one of the following: a file name, a signature, a zero sequence, and a repeating pattern within the second backup data.

[0066] This provides the advantage that even if the second backup data has an unknown data format, relevant data within the second backup data can be identified.

[0067] In an implementation of the second aspect, when one or more metadata markers are detected within the second backup data, the method further includes: indicating the start and end of each entry of the second backup data based on the detected one or more metadata markers, wherein each entry includes an object or a file; splitting the second backup data into separate entries based on the indicated start and end of each entry; and for each entry of the second backup data, determining the corresponding entry in the first backup data.

[0068] This provides an advantage in that the second backup data can be split into separate entries even if the second backup data has an unknown data format.

[0069] In an implementation of the second aspect, the method further includes: determining one or more parameters in each entry of the first backup data and one or more parameters in each entry of the second backup data; for each entry, determining a parameter difference based on one or more parameters of the first backup data and one or more parameters of the second backup data; and when the parameter difference exceeds a preset threshold, determining a ransomware attack on the second backup data.

[0070] By enabling ransomware attack detection in each entry of the second backup data, the efficiency of ransomware detection in backup data whose data format is unknown may be improved.

[0071] In an implementation of the second aspect, the method further includes: determining the entropy of each file at the file system level between snapshots of the same data body in the first backup data, and the entropy of each file at the file system level between snapshots of the same data body in the second backup data; for each file at the file system level between the snapshots of the same data body, determining an entropy difference based on the entropy of the first backup data and the entropy of the second backup data; and analyzing the entropy difference for each file at the file system level between the snapshots of the same data body, and determining a ransomware attack on the second backup data based on the analyzed entropy difference.

[0072] For example, analysis may be performed on the entropy differences of each file at the file system level between snapshots of the same data volume using a machine learning algorithm.

[0073] In an implementation of the second aspect, when the metadata tag within the second backup data is not detected, the method further includes: identifying a file name for each file within the second backup data; splitting the second backup data into separate files based on the identified file name for each file; for each file of the second backup data, determining a corresponding file in the first backup data; determining one or more parameters of the first backup data in each file of the first backup data, and one or more parameters of the second backup data in each file of the second backup data; for each file, determining a parameter difference based on one or more parameters of the first backup data and one or more parameters of the second backup data, and determining a ransomware attack on the second backup data when the parameter difference of one of the files exceeds a preset threshold.

[0074] This provides the advantage that the file name can be found in the second backup data even if the second backup data has an unknown data format. Further advantageously, since ransomware detection is performed in each file of the second backup data, the efficiency of ransomware detection in backup data with an unknown data format is improved.

[0075] In an implementation of the second aspect, when the metadata tag in the second backup data is not detected, the method further includes: determining the entropy of the first backup data; determining the amount of change in the second backup data, and determining the entropy of the amount of change in the second backup data; determining an entropy difference based on the entropy of the first backup data and the entropy of the amount of change in the second backup data, and when the entropy difference exceeds a preset threshold, determining a ransomware attack on the second backup data.

[0076] This provides the advantage that ransomware detection in backup data whose data format is unknown can be achieved every time an incremental backup is performed, thereby improving efficiency.

[0077] In an implementation of the second aspect, the method further includes: using one or more parameters in each entry of the first backup data and one or more parameters in each entry of the second backup data, or one or more parameters in each file of the first backup data and one or more parameters in each file of the second backup data, as input to the ransomware detection algorithm.

[0078] For example, the ransomware detection algorithm may be an existing ransomware detection algorithm for a known data format.

[0079] This increases the efficiency of ransomware detection, since existing and well-known ransomware detection algorithms can be used on a per-entry basis, even if the entire second backup has an unknown data format.

[0080] In an implementation of the second aspect, when the metadata marker in the second backup data is not detected, the method further includes: searching for one or more predefined signatures in the second backup data; and determining a ransomware attack on the second backup data if one or more predefined signatures are found in the second backup data.

[0081] This provides the advantage that ransomware in the second backup data can be easily detected by identifying a predefined signature in the original data of the second backup data.

[0082] For example, one or more predefined signatures may be selected by querying a database including mapping relationships between several ransomware and their related signatures.

[0083] In an implementation of the second aspect, the method further includes: sending a warning message to a controller, wherein the warning message includes information alerting a user about a ransomware attack on the second backup data; and displaying the warning message to the user by a production device accessible to the user.

[0084] This provides the advantage of preventing the user from further writing new data that might be vulnerable to theft by ransomware.

[0085] According to a third aspect, there is provided a computer program product comprising program code for, when implemented on a processor, performing the method according to the second aspect and implementations thereof.

[0086] The computer program product according to the third aspect comprises the features of the corresponding implementation of the method of the second aspect.

[0087] The method according to the second aspect and the computer program product according to the third aspect and its implementation provide the same advantages and effects as described above for the device of the first aspect and its corresponding implementation.

[0088] It should be noted that all devices, elements, units and modules described in this application can be implemented by software or hardware elements or any type of combination thereof. All steps performed by various entities described in this application and the functions to be performed by various entities described are intended to refer to the corresponding entities for performing the corresponding steps and functions. Although in the description of the following specific embodiments, the specific functions or steps performed by external entities are not reflected in the description of the specific detailed elements of the entities performing the specific steps or functions, it should be clear to the technician that these methods and functions can be implemented by corresponding hardware or software elements or any combination thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0089] In conjunction with the accompanying drawings, the following description of specific embodiments illustrates the above aspects and implementations of the present invention, wherein:

[0090] Figure 1A device for detecting ransomware in backup data with unknown data format according to an embodiment of the present invention is shown;

[0091] Figure 2 A device for detecting ransomware in backup data with unknown data format according to another embodiment of the present invention is shown;

[0092] Figure 3 An example of a flow chart for performing ransomware detection in backup data with unknown data format according to an embodiment of the present invention is shown;

[0093] Figure 4 A method for detecting ransomware in backup data with unknown data format according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0094] Figure 1 A schematic diagram of a device 100 according to an embodiment of the present invention is shown. The device 100 is used to detect ransomware in backup data with unknown data format. The device 100 includes a controller 102 and a processor 104. The controller 102 is used to obtain first backup data 103a and second backup data 103b from an auxiliary storage 106. The second backup data 103b is generated in the auxiliary storage 106 later than the first backup data 103a, so the first backup data 103a can be understood as an earlier or previous backup data. The second backup data 103b has an unknown data format, and the first backup data 103a has a known data format or an unknown data format.

[0095] In the present invention, the first backup data 103a may include one or more backup data copies, and the one or more backup data copies are generated in the auxiliary storage 106 earlier than the second backup data 103b, that is, the first backup data 103a may include one or more earlier backup data.

[0096] The processor 104 is in communication with the controller 102 and is configured to detect a ransomware attack on the second backup data 103 b based on one or more parameters of the first backup data 103 a and one or more parameters of the second backup data 103 b .

[0097] The one or more parameters of the first backup data 103a indicate at least one of the amount of change, compression ratio, deduplication rate, entropy, and predefined signature of the first backup data 103a. The one or more parameters of the second backup data 103b indicate at least one of the amount of change, compression ratio, deduplication rate, entropy, and predefined signature of the second backup data 103b.

[0098] The solution of the present invention may be based on: utilizing built-in properties of the auxiliary storage 106 to calculate properties for ransomware detection (one or more parameters of the first backup data 103a and one or more parameters of the second backup data 103b), and attempting to understand unknown data of the first backup data 103a and / or the second backup data 103b by using internal storage information and several analyses of the calculated properties.

[0099] Typically, the production device or production system can be directly accessed by the user and can be used to perform normal operations, while the auxiliary storage 106 can be used to back up the data of the production system. A first backup can be performed on the auxiliary storage 106, thereby generating the first backup data 103a. Subsequently, the user can write additional data to all files in the production system. Then, if a ransomware attack occurs, the ransomware will affect all or part of the files in the production system, thereby generating a large amount of data with unknown data formats. After the ransomware infection, a second backup can be performed on the auxiliary storage 106 at a time later than the time when the first backup data 103a is executed, thereby generating the second backup data 103b with unknown data formats. The second backup data 103b may include one or more files infected by the ransomware. The device 100 according to the present invention can start ransomware detection after completing the second backup in the auxiliary storage, wherein the production system is no longer involved.

[0100] In an exemplary embodiment, the processor 104 is further configured to determine a difference between the first backup data 103a and the second backup data 103b based on one or more parameters of the first backup data 103a and one or more parameters of the second backup data 103b. Then, the processor 104 is configured to determine a ransomware attack on the second backup data 103b when the determined difference exceeds a preset threshold.

[0101] In the present invention, determining the ransomware attack on the second backup data 103b may refer to: the processor 104 is used to determine that the probability of the second backup data 103b being attacked by the ransomware is higher than a preset threshold. For example, but not limited to, the threshold of the difference between the first backup data 103a and the second backup data 103b may be preset to 0.95, or 0.98, or 0.99, so that the processor 104 can detect that the probability of the ransomware attack on the second backup data 103b is greater than 95%, or 98% or 99%, respectively. The larger the value of the preset threshold, the higher the accuracy of the device 100 in detecting the ransomware of the second backup data 103b.

[0102] Determining the difference between the first backup data 103a and the second backup data 103b based on one or more parameters of the first backup data 103a and one or more parameters of the second backup data 103b may refer to calculating a parameter difference between one or more parameters of the first backup data 103a and one or more parameters of the second backup data 103b.

[0103] In one example, the processor 104 may determine the amount of change of the first backup data 103a and the amount of change of the second backup data 103b. Then, the processor 104 may determine the difference between the amount of change of the first backup data 103a and the amount of change of the second backup data 103b. The amount of change of the second backup data 103b being greater than the amount of change of the first backup data 103a may indicate that the second backup data 103b has been attacked by ransomware. Therefore, if the calculated difference in the amount of change exceeds a preset threshold, the processor 104 may determine a ransomware attack on the second backup data 103b.

[0104] In another example, the processor 104 may determine a compression ratio of the first backup data 103a and a compression ratio of the second backup data 103b, and then the processor 104 may determine a difference between the compression ratio of the first backup data 103a and the second compression ratio of the second backup data 103b. A smaller compression ratio of the second backup data 103b than the compression ratio of the first backup data 103a may indicate that the second backup data 103b is attacked by ransomware. Therefore, if the calculated compression ratio difference exceeds a preset threshold, the processor 104 may determine a ransomware attack on the second backup data 103b.

[0105] In another example, the processor 104 may determine a deduplication rate of the first backup data 103a and a deduplication rate of the second backup data 103b. Then, the processor 104 may determine a difference between the deduplication rate of the first backup data 103a and the deduplication rate of the second backup data 103b. A smaller deduplication rate of the second backup data 103b than the compression ratio of the first backup data 103a may indicate that the second backup data 103b is attacked by ransomware. Therefore, if the calculated deduplication rate difference exceeds a preset threshold, the processor 104 may determine a ransomware attack on the second backup data 103b.

[0106] In another example, the processor 104 may determine the entropy of the first backup data 103a and the entropy of the second backup data 103b. Then, the processor 104 may determine the difference between the entropy of the first backup data 103a and the entropy of the second backup data 103b. The entropy of the second backup data 103b being greater than the entropy of the first backup data 103a may indicate that the second deduplication rate has been attacked by ransomware. Therefore, if the calculated entropy difference exceeds a preset threshold, the processor 104 may determine a ransomware attack on the second backup data 103b.

[0107] In another example, the processor 104 may determine the amount of change and / or compression ratio and / or deduplication rate and / or entropy, and any combination thereof, of the first backup data 103a, and the amount of change and / or compression ratio and / or deduplication rate and / or entropy, or any combination thereof, of the second backup data 103b. The processor 104 may then determine a difference between one or more parameters of the first backup data 103a and one or more parameters of the second backup data 103b, and when the determined difference exceeds a preset threshold, may further determine a ransomware attack on the second backup data 103b.

[0108] The ransomware detection speed in the backup data with unknown data format provided in the above embodiments and examples is faster and can be performed during the storage backup process.

[0109] In the embodiments described below, ransomware detection in backup data whose data format is unknown requires further data analysis and provides higher ransomware detection accuracy.

[0110] In one embodiment, the processor 104 is further configured to search for one or more metadata tags in the second backup data 103b. The one or more metadata tags include at least one of the following: a file name, a signature, a zero sequence, or a repeating pattern in the second backup data 103b.

[0111] When one or more metadata markers in the second backup data 103b are detected, the processor 104 is further configured to indicate the start and end of each entry of the second backup data 103b based on the detected one or more metadata markers, wherein each entry includes an object or a file. Then, the processor 104 is configured to split the second backup data 103b into separate entries based on the indicated start and end of each entry. In addition, for each entry of the second backup data 103b, the processor 104 is configured to determine a corresponding entry in the first backup data 103a.

[0112] Then, the processor 104 is used to determine one or more parameters in each entry of the first backup data 103a and one or more parameters in each entry of the second backup data 103b. The processor 104 is also used to: for each entry, determine a parameter difference based on one or more parameters of the first backup data 103a and one or more parameters of the second backup data 103b. Then, the processor 104 is used to determine a ransomware attack on the second backup data 103b when the parameter difference exceeds a preset threshold.

[0113] In one example, after detecting one or more metadata markers within the second backup data 103b, splitting the second backup data 103b into separate entries based on the start and end of each entry indicated, and for each entry, determining the corresponding entry in the first backup data 103a, the processor 104 can determine the entropy of each separated entry in the first backup data 103a and the entropy of each separated entry in the second backup data 103b. The processor 104 can also determine the difference between the entropy of the entry in the first backup data 103a and the entropy of the same entry in the second backup. This operation is performed for each entry of the first backup data 103a and the second backup data 103b. The entropy of a particular entry of the second backup data 103b is greater than the entropy of the same entry in the first backup data 103a, which can indicate that the particular entry of the second backup data 103b has been attacked by ransomware. Therefore, if the entropy difference determined for the entry exceeds a preset threshold, the processor 104 can be used to determine a ransomware attack on the second backup data 103b.

[0114] In this embodiment, the parameter difference based on one or more parameters of the first backup data 103a and one or more parameters of the second backup data 103b is determined for each entry, rather than for the complete first backup data 103a and the second backup data 103b. Therefore, the accuracy of ransomware detection for the second backup data 103b with unknown data format is enhanced, because once the parameter difference determined in a single entry exceeds a preset threshold, the processor 104 can determine that the second backup data 103b has been attacked by ransomware.

[0115] Optionally, since the present embodiment allows the second backup data 103b of unknown data format to be split into separate entries (i.e., files or objects), the processor 104 may also be used to use one or more parameters in each entry of the first backup data 103a and one or more parameters in each entry of the second backup data 103b as inputs to the ransomware detection algorithm. Alternatively, the processor 104 may also be used to use one or more separate entries of the first backup data 103a and one or more separate entries of the second backup data 103b as inputs to the ransomware detection algorithm.

[0116] For example, the ransomware detection algorithm may be an existing ransomware detection algorithm for a known data format. In this way, even if the second backup data 103b has an unknown data format, this embodiment optionally allows the use of an existing and well-known ransomware detection algorithm on a per-entry basis.

[0117] In one embodiment, once the entry in the second backup data 103b is determined, and when the entry includes a data file, the processor 104 is further used to determine the entropy of each file at the file system level between the snapshots of the same data body in the first backup data 103a, and the entropy of each file at the file system level between the snapshots of the same data body in the second backup data 103b; then, the processor 104 is used to: for each file at the file system level between the snapshots of the same data body, determine the entropy difference based on the entropy of the first backup data 103a and the entropy of the second backup data 103b. The processor 104 is also used to analyze the entropy difference of each file at the file system level between the snapshots of the same data body, and determine the ransomware attack on the second backup data 103b based on the analyzed entropy difference.

[0118] For each file at the file system level between snapshots of the same data body, analysis of the entropy difference can be performed by using a machine learning algorithm so that for each file at the file system level between snapshots of the same data body, the entropy of the second backup data 103b is compared with the entropy of the first backup data 103a, thereby indicating whether the second backup data 103b is attacked by ransomware.

[0119] In one embodiment, when the metadata tag in the second backup data 103b is not detected, the processor 104 is also used to identify the file name of each file in the second backup data 103b. The identification of the file name of each file in the second backup data 103b can be performed by using a special predefined regular expression or a machine learning algorithm. Then, the processor 104 is used to split the second backup data 103b into separate files based on the file name of each file identified. The processor 104 is also used to: for each file in the second backup data 103b, determine the corresponding file in the first backup data 103a.

[0120] In addition, the processor 104 is used to determine one or more parameters of the first backup data 103a in each file of the first backup data 103a, and one or more parameters of the second backup data 103b in each file of the second backup data 103b. Then, the processor 104 is used to: for each file, determine a parameter difference based on one or more parameters of the first backup data 103a and one or more parameters of the second backup data 103b. The processor 104 is also used to determine a ransomware attack on the second backup data 103b when the parameter difference of one of the files exceeds a preset threshold.

[0121] Optionally, the processor 104 may also be configured to use the file name of each identified file as an input to a ransomware detection algorithm. Specifically, the ransomware detection algorithm may be an existing ransomware detection algorithm for a known data format.

[0122] Optionally, the processor 104 may also be configured to use one or more parameters in each file of the first backup data 103a and one or more parameters in each file of the second backup data 103b as inputs to a ransomware detection algorithm. Specifically, the ransomware detection algorithm may be an existing ransomware detection algorithm for a known data format.

[0123] In this way, the present embodiment optionally allows existing ransomware detection algorithms to be used on a per-file basis even if the entire second backup has an unknown data format.

[0124] In one embodiment, when the metadata tag in the second backup data 103b is not detected, the processor 104 is further configured to determine the entropy of the first backup data 103a. Then, the processor is configured to determine the amount of change in the second backup data 103b and the entropy of the amount of change in the second backup data 103b. The processor is further configured to determine an entropy difference based on the entropy of the first backup data 103a and the entropy of the amount of change in the second backup data 103b, and when the entropy difference exceeds a preset threshold, determine a ransomware attack on the second backup data 103b.

[0125] In one embodiment, when the metadata tag in the second backup data 103b is not detected, the processor 104 is further configured to search for one or more predefined signatures in the second backup data 103b. The one or more predefined signatures can uniquely identify ransomware. Then, the processor 104 is configured to: if one or more predefined signatures are found in the second backup data 103b, determine a ransomware attack on the second backup data 103b.

[0126] The device 100 may select one or more predefined signatures by querying a database including mapping relationships between several ransomware and their related signatures.

[0127] The device 100 may include and maintain its own database. Alternatively, the device 100 may use an external ransomware database.

[0128] The ransomware detection in backup data with unknown data format provided in this embodiment can be performed in parallel with the ransomware detection in backup data with unknown data format provided in some of the above embodiments. The parallel implementation of the disclosed embodiment provides higher accuracy in ransomware detection in backup data with unknown data format and can be used to verify ransomware detection.

[0129] For example, when no metadata tag is detected in the second backup data 103b, the processor 104 may be used to search for one or more predefined signatures in the second backup data 103b, and if one or more predefined signatures are found in the second backup data 103b, a ransomware attack on the second backup data 103b is determined. In addition, as a verification of the detection of the ransomware attack, the processor 104 may also be used to: identify the file name of each file in the second backup data 103b; split the second backup data 103b into separate files based on the file name of each identified file; for each file in the second backup data 103b, determine the corresponding file in the first backup data 103a. The identification of the file name of each file in the second backup data 103b may be performed by using a special predefined regular expression or a machine learning algorithm.

[0130] Then, the processor 104 can be used to split the second backup data 103b into separate files based on the file name of each file identified. In addition, the processor 104 can be used to: for each file of the second backup data 103b, determine the corresponding file in the first backup data 103a. The processor 104 can also be used to determine one or more parameters of the first backup data 103a in each file of the first backup data 103a, and one or more parameters of the second backup data 103b in each file of the second backup data 103b. Then, the processor 104 can: for each file, determine the parameter difference based on one or more parameters of the first backup data 103a and one or more parameters of the second backup data 103b. The processor 104 can also be used to determine a ransomware attack on the second backup data 103b when the parameter difference of one of the files exceeds a preset threshold.

[0131] Therefore, in the case where the file name of a specific file in the second backup data 103b is not identified, if the file is infected with ransomware, the device 100 cannot determine the ransomware attack on the second backup data 103b; however, if one or more predefined signatures are searched and found in the second backup data 103b, the device 100 can still determine the ransomware attack on the second backup data 103b. On the contrary, if the second backup data 103b is infected with ransomware that is not in the ransomware database, the device 100 cannot determine the ransomware attack on the second backup data 103b; however, if for each separated file, the parameter difference determined based on one or more parameters of the first backup data 103a and one or more parameters of the second backup data 103b exceeds a preset threshold, the device 100 can still determine the ransomware attack on the second backup data 103b.

[0132] Alternative examples are obtained by executing other embodiments according to the invention in parallel.

[0133] exist Figure 2 In the illustrated embodiment, the processor 104 is further configured to send a warning message to the controller 102. The warning message includes information alerting the user about the ransomware attack on the second backup data 103b. The controller 102 is further configured to communicate with the production device 108. The production device 108 is accessible by the user, and the production device 108 is configured to display the warning message to the user.

[0134] Thus, preventing the user from further writing new data that could be vulnerable to theft by ransomware.

[0135] In one embodiment, the device 100 is implemented inside the auxiliary storage 106 or outside the auxiliary storage 106. Alternatively, the device 100 is implemented in an intelligent device, which may be located inside the auxiliary storage 106 or outside the auxiliary storage 106. Alternatively, during the data transfer to the auxiliary storage system, the device 100 may be implemented in an intelligent device outside the auxiliary storage 106. It should be noted that this can reduce the detection time of the backup data.

[0136] For example, the device 100 can be implemented in the secondary storage 106 at the level of deduplication segments. In this level, some information across multiple segments may be lost, but a ransomware attack on the second backup data 103b can still be detected. In this way, the performance of the device 100 can be improved by a hundred times.

[0137] In another example, the device 100 may be implemented in a smart device external to the secondary storage 106 during the data transfer into the secondary storage system.

[0138] The controller 102 may also be used to lock the first backup data 103a once a ransomware attack on the second backup data 103b is detected. Typically, in a computer system, there is a retention policy that deletes old backup data from the secondary storage due to limited disk capacity. Therefore, in the event that a ransomware attack is detected in the second backup data 103b, the first backup data 103a may not be deleted from the secondary storage 106 in the normal process of deleting old backup data, wherein the old backup data may include backup data generated in the secondary storage 106 much earlier than the second backup data 103b. Therefore, even if the user data in the second backup data 103b is lost or blocked due to a ransomware attack, the user may have access to at least part of the data or at least an earlier version of the data, and therefore, the user information is not completely lost or blocked.

[0139] Figure 3 An example of a flowchart for detecting ransomware in backup data with unknown data format according to the above embodiment of the present invention is shown.

[0140] exist Figure 3 In the right branch of , it is described that when the controller 102 obtains the first backup data 103a and the second backup data 103b, the processor 104 can be used to check whether the second backup data 103b has an unknown data format, while the first backup data 103a can have a known data format or an unknown data format. When the second backup data 103b has an unknown data format, the processor can be used to search for one or more metadata tags within the second backup data 103b, and when the metadata tag is not detected, the processor 104 can also be used to search for one or more predefined signatures within the second backup data 103b. Then, if one or more predefined signatures are found within the second backup data 103b, the processor 104 can determine a ransomware attack on the second backup data 103b.

[0141] Additionally or alternatively, the processor 104 may also be used to: identify the file name of each file in the second backup data 103b; split the second backup data 103b into separate files based on the file name of each identified file; for each file of the second backup data 103b, determine the corresponding file in the first backup data 103a; determine one or more parameters of the first backup data 103a in each file of the first backup data 103a and one or more parameters of the second backup data 103b in each file of the second backup data 103b; for each file, determine a parameter difference based on one or more parameters of the first backup data 103a and one or more parameters of the second backup data 103b, and when the parameter difference of one of the files exceeds a preset threshold, determine a ransomware attack on the second backup data 103b. Additionally or alternatively, when splitting the second backup data 103b into separate files, the processor 104 may be used to use the file name of each identified file as an input to a ransomware detection algorithm. The ransomware detection algorithm may be an existing ransomware detection algorithm for a known data format.

[0142] exist Figure 3 In the example of , when the second backup data 103b has a known data format, the processor can identify the file name of each file of the second backup data 103b, and the file name can be used as an input to the ransomware detection algorithm whose data format is known. Figure 3 . Additionally or alternatively, when one or more metadata markers within the second backup data 103b are detected, the processor 104 may also be used to: indicate the start and end of each entry of the second backup data 103b based on the detected one or more metadata markers, wherein each entry includes an object or a file; split the second backup data 103b into separate entries based on the indicated start and end of each entry; and for each entry of the second backup data 103b, determine the corresponding entry in the first backup data (103a). The processor may then be used to determine one or more parameters in each entry of the first backup data 103a and one or more parameters in each entry of the second backup data 103b, and may also: for each entry, determine a parameter difference based on one or more parameters of the first backup data 103a and one or more parameters of the second backup data 103b. The processor may also be used to determine a ransomware attack on the second backup data 103b when the parameter difference exceeds a preset threshold.

[0143] Alternatively, also in Figure 3In the left branch of , the processor 104 can be used to: determine the entropy of each file at the file system level between snapshots of the same data body in the first backup data 103a, and the entropy of each file at the file system level between snapshots of the same data body in the second backup data 103b; for each file at the file system level between snapshots of the same data body, determine the entropy difference based on the entropy of the first backup data 103a and the entropy of the second backup data 103b; and analyze the entropy difference of each file at the file system level between the snapshots of the same data body, and determine a ransomware attack on the second backup data 103b based on the analyzed entropy difference.

[0144] The device 100 may include a processing circuit (not shown) for performing, carrying out or starting various operations of the device 100 herein. The processing circuit may include hardware and software. The hardware may include analog circuits or digital circuits, or both analog circuits and digital circuits. The digital circuit may include components such as an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP) or a multi-purpose processor. In one embodiment, the processing circuit includes one or more processors and a non-transient memory connected to the one or more processors. The non-transient memory may carry an executable program code, and when one or more processors execute the executable program code, the executable program code causes the device 100 to perform, carry out or start the operation or method described herein.

[0145] Figure 4 The steps of a method 200 for detecting ransomware in backup data with unknown data format according to an embodiment of the present invention are shown. Specifically, the method 200 is executed by the device 100 as described above.

[0146] The method 200 comprises step S202: obtaining first backup data 103a and second backup data 103b from auxiliary storage, wherein the second backup data 103b is generated in the auxiliary storage later than the first backup data 103a. The second backup data 103b has an unknown data format, and the first backup data 103a has a known data format or an unknown data format.

[0147] The method 200 further includes step S204: detecting a ransomware attack on the second backup data 103 b based on one or more parameters of the first backup data 103 a and one or more parameters of the second backup data 103 b .

[0148] The one or more parameters of the first backup data 103a indicate at least one of a change amount, a compression ratio, a deduplication rate, an entropy, or a predefined signature of the first backup data 103a. The one or more parameters of the second backup data 103b indicate at least one of a change amount, a compression ratio, a deduplication rate, an entropy, or a predefined signature of the second backup data 103b.

[0149] The method 200 may further comprise actions according to the above-described embodiments of the device 100. Therefore, the method 200 achieves the same advantages as the device 100.

[0150] The present invention also provides a computer program product, the computer program product comprising program code, when the program code is implemented on a processor, executes the following Figure 4 The method 200 shown. The computer program may be included in a computer readable medium of a computer program product. The computer readable medium may include essentially any memory, such as a read-only memory (ROM), a programmable read-only memory (PROM), an erasable PROM (EPROM), a flash memory, an electrically erasable PROM (EEPROM), or a hard drive.

[0151] The invention has been described in conjunction with various embodiments and implementations as examples. However, those skilled in the art will be able to understand and arrive at other variations by practicing the matter claimed, studying the drawings, the invention and the independent claims. In the claims and the specification, the word "comprising" does not exclude other elements or steps, and "a," "an" does not exclude a plurality. A single element or other unit may fulfil the functions of several entities or items listed in the claims. The listing of some measures in mutually different dependent claims does not indicate that a combination of these measures cannot be used in a beneficial implementation.

Claims

1. A device (100) for detecting ransomware in backup data of unknown data format, characterized in that: The device (100) comprises: A controller (102) for acquiring first backup data (103a) and second backup data (103b) from an auxiliary storage (106), wherein the second backup data (103b) is generated in the auxiliary storage (106) later than the first backup data (103a), wherein the second backup data (103b) has an unknown data format, and wherein the first backup data (103a) has a known data format or an unknown data format; and A processor (104) configured to detect a ransomware attack on the second backup data (103b) based on one or more parameters of the first backup data (103a) and one or more parameters of the second backup data (103b); wherein the one or more parameters of the first backup data (103a) indicate at least one of: a change amount, a compression ratio, a deduplication ratio, an entropy, or a predefined signature; and The one or more parameters of the second backup data (103b) indicate at least one of the following: a change amount, a compression ratio, a deduplication rate, an entropy, or a predefined signature.

2. The device (100) according to claim 1, characterized in that The processor (104) is further configured to: determining a difference between the first backup data (103a) and the second backup data (103b) based on the one or more parameters of the first backup data (103a) and the one or more parameters of the second backup data (103b); as well as When the determined difference exceeds a preset threshold, a ransomware attack on the second backup data (103b) is determined.

3. The device (100) according to claim 1, characterized in that The processor (104) is further configured to: searching for one or more metadata tags in the second backup data (103b); The one or more metadata tags include at least one of the following: a file name, a signature, a zero sequence, and a repeating pattern within the second backup data (103b).

4. The device (100) according to claim 3, characterized in that When the one or more metadata tags in the second backup data (103b) are detected, the processor (104) is further configured to: Indicating the beginning and the end of each entry of the second backup data (103b) based on the detected one or more metadata markers, wherein each entry comprises an object or a file; splitting the second backup data (103b) into separate entries based on the indicated start and end of each entry; and For each entry of the second backup data (103b), a corresponding entry in the first backup data (103a) is determined.

5. The device (100) according to claim 4, characterized in that The processor (104) is further configured to: determining the one or more parameters in each entry of the first backup data (103a) and the one or more parameters in each entry of the second backup data (103b); For each entry, determining a parameter difference based on one or more parameters of the first backup data (103a) and one or more parameters of the second backup data (103b); as well as When the parameter difference exceeds a preset threshold, a ransomware attack on the second backup data (103b) is determined.

6. The device (100) according to claim 4, characterized in that The processor (104) is further configured to: Determining the entropy of each file at the file system level between snapshots of the same data volume in the first backup data (103a), and the entropy of each file at the file system level between snapshots of the same data volume in the second backup data (103b); For each file of the file system hierarchy between the snapshots of the same data volume, determining an entropy difference based on the entropy of the first backup data (103a) and the entropy of the second backup data (103b); as well as The entropy difference of each file at the file system level between the snapshots of the same data volume is analyzed, and a ransomware attack on the second backup data (103b) is determined based on the analyzed entropy difference.

7. The device (100) according to claim 3, characterized in that When the metadata tag in the second backup data (103b) is not detected, the processor (104) is further configured to: Identifying the file name of each file in the second backup data (103b); splitting the second backup data (103b) into separate files based on the identified file name of each file; For each file in the second backup data (103b), determining a corresponding file in the first backup data (103a); Determining the one or more parameters of the first backup data (103a) in each file of the first backup data (103a), and the one or more parameters of the second backup data (103b) in each file of the second backup data (103b); For each file, determining a parameter difference based on the one or more parameters of the first backup data (103a) and the one or more parameters of the second backup data (103b), and When the parameter difference of one of the files exceeds a preset threshold, a ransomware attack on the second backup data (103b) is determined.

8. The device (100) according to claim 3, characterized in that When the metadata tag in the second backup data (103b) is not detected, the processor (104) is further configured to: determining the entropy of the first backup data (103a); Determining a change amount of the second backup data (103b), and determining an entropy of the change amount of the second backup data (103b); determining an entropy difference value based on the entropy of the first backup data (103a) and the entropy of the change amount of the second backup data (103b), and When the entropy difference exceeds a preset threshold, a ransomware attack on the second backup data (103b) is determined.

9. The device (100) according to any one of claims 5 or 7, characterized in that The processor (104) is further configured to: The one or more parameters in each entry of the first backup data (103a) and the one or more parameters in each entry of the second backup data (103b), or the one or more parameters in each file of the first backup data (103a) and the one or more parameters in each file of the second backup data (103b), are used as input to a ransomware detection algorithm.

10. The device (100) according to claim 3, characterized in that When the metadata tag in the second backup data (103b) is not detected, the processor (104) is further configured to: searching for one or more predefined signatures within the second backup data (103b); and If the one or more predefined signatures are found within the second backup data (103b), a ransomware attack on the second backup data (103b) is determined.

11. The device (100) according to any one of claims 1 to 10, characterized in that: The processor (104) is further configured to send a warning message to the controller (102), wherein the warning message includes information to remind a user about a ransomware attack on the second backup data (103b); and The controller (102) is further configured to communicate with a production device (108), wherein the production device (108) is accessible to the user, and the production device (108) is configured to display the warning message to the user.

12. The device (100) according to any one of claims 1 to 11, characterized in that The device (100) is implemented inside the auxiliary storage (106) or outside the auxiliary storage (106), or the device (100) is implemented in an intelligent device located inside the auxiliary storage (106) or outside the auxiliary storage (106).

13. A method (200) for detecting ransomware in backup data of unknown data format, characterized in that: The method comprises: Acquiring (S202) first backup data (103a) and second backup data (103b) from an auxiliary storage, wherein the second backup data (103b) is generated in the auxiliary storage later than the first backup data (103a), wherein the second backup data (103b) has an unknown data format, and wherein the first backup data (103a) has a known data format or an unknown data format; and detecting (S204) a ransomware attack on the second backup data (103b) based on one or more parameters of the first backup data (103a) and one or more parameters of the second backup data (103b); wherein the one or more parameters of the first backup data (103a) indicate at least one of: a change amount, a compression ratio, a deduplication ratio, an entropy, or a predefined signature; and The one or more parameters of the second backup data (103b) indicate at least one of the following: a change amount, a compression ratio, a deduplication rate, an entropy, or a predefined signature.

14. A computer program product, characterized in that The computer program product comprises a program code for performing the method according to claim 13 when the program code is executed in a processor.

Images