Apparatus and method for ransomware detection in backup data of unknown data format

Abstract

The present invention relates to an apparatus and method for ransomware detection in backup data of unknown data format. The apparatus comprises a controller configured to obtain a first backup data and a second backup data from a secondary storage, wherein the second backup data is generated later in the secondary storage than the first backup data, and wherein the second backup data has an unknown data format and the first backup data has a known data format or an unknown data format; and a processor configured to detect a ransomware attack on the second backup data based on one or more parameters of the first backup data and one or more parameters of the second backup data. The one or more parameters of the first backup data and the one or more parameters of the second backup data are indicative of at least one of a change amount, a compression ratio, a deduplication rate, an entropy, or a predefined signature.

Description

TECHNICAL FIELD

[0001] The present invention relates to an apparatus for ransomware detection in backup data of unknown data format. The invention also provides a method for ransomware detection in backup data of unknown data format, and a computer program product for performing the method. BACKGROUND

[0002] Ransomware is a type of malicious software that threatens to publish data or block access to data or computer systems, usually by encrypting the data or systems until the victim pays a ransom. In many cases, the ransom demand comes with a deadline. If the victim does not pay on time, the data is lost forever or the ransom increases.

[0003] Ransomware attacks are becoming more common, with some large companies in North America and Europe falling victim to them. Cyber criminals will attack any consumer or any business, with victims spanning various industries.

[0004] Ransomware is a type of malicious software designed to extort money from victims by preventing them from accessing data on their systems. The two most popular types of ransomware are encryption programs and screen locks. Encryption programs, as the name suggests, encrypt data on the system, making the content unusable without a decryption key. Screen locks simply prevent access to the system by "locking" the screen, showing that the system is encrypted.

[0005] With both encryption programs and screen locks, the victim is usually notified on the locked screen to purchase cryptocurrency to pay the ransom. Once the ransom is paid, the victim receives a decryption key, which can be used to attempt to decrypt the files. However, there is no guarantee that decryption will be successful, with multiple sources reporting varying degrees of success after paying the ransom. Sometimes the victim never receives the decryption key. Even after paying the ransom and the data is released, some attackers install malware on the computer system.

[0006] While initially focused mainly on personal computers, encryption ransomware is increasingly targeting enterprise users, as businesses often pay more than individuals to unlock critical systems and restore daily operations.

[0007] A corporate ransomware infection or virus usually begins with a malicious email. An unsuspecting user opens an attachment or clicks on a malicious or compromised URL. At this point, the ransomware agent is installed and begins encrypting key files and any additional file shares on the victim's PC. After the data is encrypted, the ransomware displays a message on the infected device. The message explains what happened and how to pay the attacker. The ransomware promises that if the victim pays, the victim will receive the code to unlock their data.

[0008] A victimized business of ransomware can suffer significant financial losses due to the impact on productivity and data loss. Attackers with access to the data extort the victim by threatening to publish the data and expose a data breach incident, and the victim pays the ransom, so organizations that do not pay promptly can suffer other adverse effects such as brand damage and litigation.

[0009] Ransomware causes production to stall, so if a ransomware infection is detected, the victim's first reaction should be to take control of the ransomware. After taking control of the ransomware, the victim can recover the data from a data backup or pay the ransom. Root cause analysis helps identify the victim's vulnerabilities, but any delay in data recovery impacts production and business revenue.

[0010] To prevent a ransomware attack, users can protect their email from ransomware. Phishing and spam emails are the primary means of spreading ransomware attacks. A secure email gateway with targeted attack protection capabilities is essential to detect and block malicious emails that send ransomware. These solutions can block malicious attachments, malicious documents, and URLs in emails sent to user computers.

[0011] Users can also protect their mobile devices from ransomware. Mobile attack protection products, when used in conjunction with mobile device management (MDM) tools, can analyze applications on user devices and immediately alert users and IT of any applications that can compromise the environment.

[0012] In addition, it is recommended to protect users' web surfing from ransomware. A secure web gateway can scan users' web surfing traffic to identify malicious web ads that can direct them to ransomware.

[0013] Users can also monitor their servers, networks, and backup critical systems. Monitoring tools can detect abnormal file access activity, viruses, network command and control (C&C) traffic, and CPU load, stopping ransomware activation in time. Keeping a full image copy of critical systems can reduce the risk of machine crashes or critical operational bottlenecks caused by encryption.

[0014] Like most malware, ransomware is designed to infect a computer and remain undetected until its purpose is fulfilled. In the case of ransomware, the attacker’s goal is for the victim to realize the infection only when a ransom demand is received.

[0015] Common ransomware solutions aim to identify infections as early as possible during the ransomware infection process, before any damage is caused. To do this, many ransomware detection techniques are used to overcome the stealth and evasion features of ransomware.

[0016] Early detection is critical for ransomware because the damage caused can be irreversible. If the ransomware encrypts data that is not included in a secure backup, that data can not be recoverable even if the victim pays the ransom. Therefore, identifying and removing a ransomware infection before encryption begins is key to minimizing its impact.

[0017] As ransomware evolves, early detection becomes even more important. Modern ransomware variants often exfiltrate sensitive data from a company before encrypting it. If a ransomware attack can be detected before data exfiltration occurs, the company can avoid a data breach, which can be costly and embarrassing.

[0018] Most current ransomware detection techniques are based on internal data formats, so these techniques require a priori knowledge of the data to be scanned. Backup applications tend to aggregate multiple files into a collection and then backup the entire collection as a single blob of data. The format of the collection object can be a well-known archive format (e.g., tar, rar, etc.) or a proprietary format specific to the backup application.

[0019] Therefore, the backup storage system does not always know the internal format of the backup copy used by the backup application, which means that the backup looks like a single blob of raw data.

[0020] Ransomware infections can be identified through several different means. Some of the most common ransomware detection mechanisms include:

[0021] (a) Signature detection: Signature-based detection is the simplest method of identifying whether malware is present on a system. Malware signatures include information such as file hashes, domain names and IP addresses of command and control infrastructure, and other indicators that can uniquely identify a malware sample. Signature-based detection systems store a library of these signatures and compare them to every file that enters or runs on the system to determine whether malware is present. However, this mechanism is becoming less and less effective. Signature-based detection is not practical for new types of malware because signatures have not yet been created for variants of malware. Today, ransomware groups often use unique versions of their malware (with different file hashes, command and control infrastructure, etc.) for each attack campaign, rendering signature-based detection ineffective.

[0022] (b) Behavior detection: Behavior-based detection algorithms can be designed to look for specific malicious activities, or to look for unusual abnormal actions. Behavior-based ransomware detection takes advantage of the fact that ransomware behavior is abnormal. For example, the encryption phase of ransomware requires the malware to open many files on the system, read their contents, and then overwrite the files with encrypted versions. If an anti-ransomware solution monitors for file operations or encryption operations and alerts for this abnormal behavior, the behavior helps with ransomware detection.

[0023] (c) Anomalous traffic detection: Ransomware can also be detected at the network level by looking for abnormal traffic. Modern ransomware exfiltrates sensitive data before encrypting it, giving the attacker additional leverage when trying to convince the victim to pay the ransom.

[0024] Implementing a large-scale data breach requires the ability to send large amounts of data from within the network to external systems under the control of the attacker. While ransomware can attempt to hide these data transfers, they can create abnormal network traffic that can be detected and traced back to the presence of ransomware on the system.

[0025] However, for backup data, the latter two techniques are practically useless because during the backup process, the user can no longer have the information required by these techniques, such as access patterns, access users, etc. Therefore, the main techniques used for backup data are detection by signature and regular expressions.

[0026] Conventional solutions require prior knowledge of the data format because predefined signatures and regular expressions are scanned at specific locations within the file (e.g., file name, file extension, file header, extended attributes, etc.), so the detection rate is low when trying to detect ransomware in backup data whose data format is unknown. SUMMARY

[0027] In view of the above, the present disclosure aims to improve the conventional solutions for ransomware detection. The object is to provide an apparatus and a corresponding method for ransomware detection in backup data of unknown data format.

[0028] The object is achieved by the solutions provided in the independent claims. Advantageous implementations are further defined in the dependent claims.

[0029] According to a first aspect, there is provided an apparatus for ransomware detection in backup data of unknown data format, comprising: a controller configured to obtain a first backup data and a second backup data from a secondary storage, wherein the second backup data is generated later than the first backup data in the secondary storage, wherein the second backup data has an unknown data format, and wherein the first backup data has a known data format or an unknown data format; and a processor configured to detect a ransomware attack on the second backup data based on one or more parameters of the first backup data and one or more parameters of the second backup data, wherein the one or more parameters of the first backup data are indicative of at least one of: a change amount, a compression ratio, a deduplication rate, an entropy, or a predefined signature; and wherein the one or more parameters of the second backup data are indicative of at least one of: a change amount, a compression ratio, a deduplication rate, an entropy, or a predefined signature.

[0030] The first backup data can comprise one or more backup data copies, which are generated earlier than the second backup data in the secondary storage.

[0031] This provides the advantage that a ransomware attack can be detected in backup data of unknown data format by analyzing parameters of the first backup data and parameters of the second backup data. Thus, an improved ransomware detection apparatus is provided.

[0032] In an implementation form of the first aspect, the processor is further configured to determine a difference between the first backup data and the second backup data based on the one or more parameters of the first backup data and the one or more parameters of the second backup data; and determine the ransomware attack on the second backup data when the determined difference exceeds a preset threshold.

[0033] This provides the advantage that the ransomware detection in the second backup data of unknown data format is faster and can be performed during the storage of the backup.

[0034] For example, the determination of the ransomware attack on the second backup data can mean that the processor is configured to determine that a probability of the second backup data being attacked by a ransomware is higher than a preset threshold.

[0035] In an implementation form of the first aspect, the processor is further configured to search for one or more metadata markers within the second backup data; wherein the one or more metadata markers comprise at least one of: a file name, a signature, a sequence of zeros, and a repeating pattern within the second backup data.

[0036] This provides the advantage that relevant data within the second backup data can be identified even if the second backup data has an unknown data format.

[0037] In an implementation form of the first aspect, when the one or more metadata markers within the second backup data are detected, the processor is further configured to: indicate a start and an end of each entry of the second backup data based on the detected one or more metadata markers, wherein each entry comprises an object or a file; split the second backup data into individual entries based on the indicated start and end of each entry; and determine, for each entry of the second backup data, a corresponding entry in the first backup data.

[0038] This provides the advantage that the second backup data can be split into individual entries even if the second backup data has an unknown data format.

[0039] In an implementation form of the first aspect, the processor is further configured to: determine one or more parameters in each entry of the first backup data and one or more parameters in each entry of the second backup data; determine, for each entry, a parameter difference value based on the one or more parameters of the first backup data and the one or more parameters of the second backup data; and determine a ransomware attack on the second backup data when the parameter difference value exceeds a pre-set threshold value.

[0040] By enabling ransomware attack detection in each entry of the second backup data, the efficiency of ransomware detection in backup data with unknown data format can be improved.

[0041] In an implementation form of the first aspect, the processor is further configured to: determine an entropy of each file of a file system hierarchy between snapshots of a same data volume in the first backup data and an entropy of each file of the file system hierarchy between the snapshots of the same data volume in the second backup data; determine, for each file of the file system hierarchy between the snapshots of the same data volume, an entropy difference value based on the entropy of the first backup data and the entropy of the second backup data; and analyze the entropy difference value of each file of the file system hierarchy between the snapshots of the same data volume and determine, based on the analyzed entropy difference value, that there is a ransomware attack on the second backup data.

[0042] For example, the analysis on the entropy difference value of each file of the file system hierarchy between the snapshots of the same data volume can be performed by using a machine learning algorithm.

[0043] In an implementation form of the first aspect, when the metadata flag within the second backup data is not detected, the processor is further configured to: identify a file name of each file within the second backup data; split the second backup data into individual files based on the identified file name of each file; for each file of the second backup data, determine a corresponding file in the first backup data; determine one or more parameters of the first backup data in each file of the first backup data and one or more parameters of the second backup data in each file of the second backup data; for each file, determine a parameter difference value based on the one or more parameters of the first backup data and the one or more parameters of the second backup data, and determine a ransomware attack on the second backup data when the parameter difference value of one of the files exceeds a preset threshold.

[0044] This provides the advantage that file names can be found in the second backup data even if the second backup data has an unknown data format. It is further advantageous that since the ransomware detection is performed in each file of the second backup data, the efficiency of the ransomware detection in backup data with unknown data format can be improved.

[0045] In an implementation form of the first aspect, when the metadata flag within the second backup data is not detected, the processor is further configured to: determine an entropy of the first backup data; determine a change amount of the second backup data, and determine an entropy of the change amount of the second backup data; determine an entropy difference value based on the entropy of the first backup data and the entropy of the change amount of the second backup data, and determine a ransomware attack on the second backup data when the entropy difference value exceeds a preset threshold.

[0046] This provides the advantage that the ransomware detection in backup data with unknown data format can be implemented every time an incremental backup is performed, thus improving the efficiency.

[0047] In an implementation form of the first aspect, the processor is further configured to: use the one or more parameters in each entry of the first backup data and the one or more parameters in each entry of the second backup data, or the one or more parameters in each file of the first backup data and the one or more parameters in each file of the second backup data, as an input of a ransomware detection algorithm.

[0048] For example, the ransomware detection algorithm can be an existing ransomware detection algorithm for known data format.

[0049] This can improve the efficiency of the ransomware detection since the existing ransomware detection algorithm can be used based on each entry even if the entire second backup has an unknown data format.

[0050] In an implementation form of the first aspect, when the metadata flag within the second backup data is not detected, the processor is further configured to search for one or more predefined signatures within the second backup data, and determine a ransomware attack on the second backup data if the one or more predefined signatures are found within the second backup data.

[0051] This provides the advantage that a ransomware in the second backup data can be easily detected by identifying the predefined signatures in the original data of the second backup data.

[0052] For example, the one or more predefined signatures can be selected by querying a database comprising mappings between a number of ransomwares and their associated signatures.

[0053] In an implementation form of the first aspect, the processor is further configured to send a warning message to a controller, wherein the warning message comprises information alerting a user about a ransomware attack on the second backup data, and the controller is further configured to communicate with a production device, wherein the production device is accessible by the user, and the production device is configured to display the warning message to the user.

[0054] This provides the advantage that the user can be prevented from further writing new data that can be susceptible to ransomware theft.

[0055] In an implementation form of the first aspect, the device is implemented inside or outside the auxiliary storage, or the device is implemented in a smart device located inside or outside the auxiliary storage.

[0056] This provides the advantage that the detection time of the backup data can be improved.

[0057] It is further advantageous that once a ransomware is detected within the second backup data, the controller can lock the first backup data so that the first backup data is not deleted from the auxiliary storage in the normal process of deleting the old backup data.

[0058] In the first aspect and the implementation forms thereof, the described functions can be implemented in hardware, software, firmware, or any combination thereof.

[0059] According to a second aspect, a method for ransomware detection in backup data of unknown data format is provided, comprising the steps of: obtaining a first backup data and a second backup data from a secondary storage, wherein the second backup data is generated later than the first backup data in the secondary storage, wherein the second backup data has an unknown data format, and wherein the first backup data has a known data format or an unknown data format; and determining a ransomware attack on the second backup data based on one or more parameters of the first backup data and one or more parameters of the second backup data; wherein the one or more parameters of the first backup data indicate at least one of: a change amount, a compression ratio, a deduplication rate, an entropy, or a predefined signature; and wherein the one or more parameters of the second backup data indicate at least one of: a change amount, a compression ratio, a deduplication rate, an entropy, or a predefined signature.

[0060] The first backup data can comprise one or more backup data copies, which are generated earlier than the second backup data in the secondary storage.

[0061] This provides the advantage that a ransomware attack can be detected in backup data of unknown data format by analyzing parameters of the first backup data and parameters of the second backup data. Thus, an improved ransomware detection device is provided.

[0062] In an implementation form of the second aspect, the method further comprises: determining a difference between the first backup data and the second backup data based on the one or more parameters of the first backup data and the one or more parameters of the second backup data; and determining the ransomware attack on the second backup data when the determined difference exceeds a preset threshold.

[0063] This provides the advantage that the ransomware detection in the second backup data of unknown data format is faster and can be performed during the storage of the backup.

[0064] In particular, determining that the second backup data is attacked by the ransomware means that a probability that the second backup data is attacked by the ransomware is higher than a preset threshold.

[0065] In an implementation form of the second aspect, the method further comprises: searching for one or more metadata markers within the second backup data; wherein the one or more metadata markers comprise at least one of: a file name, a signature, a zero sequence, and a repetition pattern within the second backup data.

[0066] This provides the advantage that relevant data within the second backup data can be identified even if the second backup data has an unknown data format.

[0067] In an implementation form of the second aspect, when detecting the one or more metadata markers within the second backup data, the method further comprises: indicating a start and an end of each entry of the second backup data based on the detected one or more metadata markers, wherein each entry comprises an object or a file; splitting the second backup data into individual entries based on the indicated start and end of each entry; and determining, for each entry of the second backup data, a corresponding entry in the first backup data.

[0068] This provides the advantage that the second backup data can be split into individual entries even if the second backup data has an unknown data format.

[0069] In an implementation form of the second aspect, the method further comprises: determining one or more parameters in each entry of the first backup data and one or more parameters in each entry of the second backup data; determining, for each entry, a parameter difference value based on the one or more parameters of the first backup data and the one or more parameters of the second backup data; and determining a ransomware attack on the second backup data when the parameter difference value exceeds a pre-set threshold.

[0070] By enabling ransomware attack detection in each entry of the second backup data, the efficiency of ransomware detection in backup data with unknown data format can be improved.

[0071] In an implementation form of the second aspect, the method further comprises: determining an entropy of each file of a file system hierarchy between snapshots of a same data volume in the first backup data and an entropy of each file of the file system hierarchy between the snapshots of the same data volume in the second backup data; determining, for each file of the file system hierarchy between the snapshots of the same data volume, an entropy difference value based on the entropy of the first backup data and the entropy of the second backup data; and analyzing the entropy difference value of each file of the file system hierarchy between the snapshots of the same data volume and determining a ransomware attack on the second backup data based on the analyzed entropy difference value.

[0072] For example, the analysis on the entropy difference value of each file of the file system hierarchy between the snapshots of the same data volume can be performed by using a machine learning algorithm.

[0073] In an implementation form of the second aspect, when no metadata tag within the second backup data is detected, the method further comprises: identifying a file name of each file within the second backup data; splitting the second backup data into individual files based on the identified file name of each file; for each file of the second backup data, determining a corresponding file in the first backup data; determining one or more parameters of the first backup data in each file of the first backup data and one or more parameters of the second backup data in each file of the second backup data; for each file, determining a parameter difference value based on the one or more parameters of the first backup data and the one or more parameters of the second backup data, and determining a ransomware attack on the second backup data when the parameter difference value of one of the files exceeds a pre-set threshold.

[0074] This provides the advantage that file names can be found in the second backup data even if the second backup data has an unknown data format. It is further advantageous that since the ransomware detection is performed in each file of the second backup data, the efficiency of the ransomware detection in backup data with unknown data format is improved.

[0075] In an implementation form of the second aspect, when no metadata tag within the second backup data is detected, the method further comprises: determining an entropy of the first backup data; determining a change quantity of the second backup data, and determining an entropy of the change quantity of the second backup data; determining an entropy difference value based on the entropy of the first backup data and the entropy of the change quantity of the second backup data, and determining a ransomware attack on the second backup data when the entropy difference value exceeds a pre-set threshold.

[0076] This provides the advantage that the ransomware detection in backup data with unknown data format can be implemented each time an incremental backup is performed, thus improving the efficiency.

[0077] In an implementation form of the second aspect, the method further comprises: using the one or more parameters in each entry of the first backup data and the one or more parameters in each entry of the second backup data, or the one or more parameters in each file of the first backup data and the one or more parameters in each file of the second backup data, as an input of a ransomware detection algorithm.

[0078] For example, the ransomware detection algorithm can be an existing ransomware detection algorithm for known data formats.

[0079] This improves the efficiency of the ransomware detection since an existing and well-known ransomware detection algorithm can be used based on each entry even if the entire second backup has an unknown data format.

[0080] In a further implementation form of the second aspect, when no metadata flag within the second backup data is detected, the method further comprises searching for one or more predefined signatures within the second backup data; and determining a ransomware attack on the second backup data if the one or more predefined signatures are found within the second backup data.

[0081] This provides the advantage that a ransomware in the second backup data can be easily detected by identifying the predefined signatures in the original data of the second backup data.

[0082] For example, the one or more predefined signatures can be selected by querying a database comprising mappings between a number of ransomware and their associated signatures.

[0083] In a further implementation form of the second aspect, the method further comprises sending a warning message to a controller, wherein the warning message comprises information alerting a user about the ransomware attack on the second backup data; and displaying the warning message to the user by a production device accessible to the user.

[0084] This provides the advantage that the user is prevented from further writing new data that can be susceptible to ransomware theft.

[0085] According to a third aspect, there is provided a computer program product comprising program code for performing the method according to the second aspect and its implementation forms when implemented on a processor.

[0086] The computer program product according to the third aspect comprises the features of the corresponding implementation forms of the method of the second aspect.

[0087] The method according to the second aspect and the computer program product according to the third aspect and its implementation forms provide the same advantages and effects for the device of the first aspect and its corresponding implementation forms as described above.

[0088] It has to be noted that all devices, elements, units and means described in the present application can be implemented by software or hardware elements or any combination thereof. All steps which are performed by the various entities described in the present application can be performed by respective entities themselves or by means of corresponding instructions or functions. All steps which are not performed by the respective entities themselves or not achieved by means of corresponding instructions or functions can be performed by a dedicated or specific device or function. It has to be noted that the entities described in the present application can be implemented as software, hardware or a combination thereof. It has to be noted that the various entities described in the present application can be implemented as software or hardware elements or any combination thereof. The software or hardware elements can be implemented by using one or more central processing units (CPUs), microprocessors, microcomputers, microcontrollers, programmable logic devices (PLDs), application-specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), digital signal processors (DSPs), or any other suitable hardware or software elements. The software elements can be implemented by means of software codes, which are executed in one or more central processing units (CPUs), microprocessors, microcomputers, microcontrollers, programmable logic devices (PLDs), application-specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), digital signal processors (DSPs), or any other suitable hardware or software elements. BRIEF DESCRIPTION OF DRAWINGS

[0089] The above aspects and implementation forms of the present application will be described in greater detail in the following specific embodiments, which are described in conjunction with the attached drawings, in which:

[0090] Figure 1An apparatus for ransomware detection in backup data with unknown data format is shown according to an embodiment of the present application;

[0091] Figure 2 An apparatus for ransomware detection in backup data with unknown data format is shown according to another embodiment of the present application;

[0092] Figure 3 An example of a flowchart for ransomware detection in backup data with unknown data format is shown according to an embodiment of the present application;

[0093] Figure 4 A method for ransomware detection in backup data with unknown data format is shown according to an embodiment of the present application. DETAILED DESCRIPTION

[0094] Figure 1 A schematic diagram of an apparatus 100 is shown according to an embodiment of the present application. The apparatus 100 is used for ransomware detection in backup data with unknown data format. The apparatus 100 comprises a controller 102 and a processor 104. The controller 102 is configured to obtain a first backup data 103a and a second backup data 103b from a secondary storage 106. The second backup data 103b is generated later than the first backup data 103a in the secondary storage 106, thus the first backup data 103a can be understood as an earlier or previous backup data. The second backup data 103b has an unknown data format, and the first backup data 103a has a known data format or an unknown data format.

[0095] In the present application, the first backup data 103a can comprise one or more backup data copies which are generated earlier than the second backup data 103b in the secondary storage 106, i.e. the first backup data 103a can comprise one or more earlier backup data.

[0096] The processor 104 is in communication with the controller 102 and is configured to detect a ransomware attack on the second backup data 103b based on one or more parameters of the first backup data 103a and one or more parameters of the second backup data 103b.

[0097] The one or more parameters of the first backup data 103a indicate at least one of a change amount, a compression ratio, a deduplication rate, an entropy, and a predefined signature of the first backup data 103a. The one or more parameters of the second backup data 103b indicate at least one of a change amount, a compression ratio, a deduplication rate, an entropy, and a predefined signature of the second backup data 103b.

[0098] The solution of the present application can be based on: calculating properties (one or more parameters of the first backup data 103a and one or more parameters of the second backup data 103b) for ransomware detection using the built-in properties of the auxiliary storage 106, and attempting to understand unknown data of the first backup data 103a and / or the second backup data 103b by using the internal storage information and several analyses on the calculated properties.

[0099] Generally, the production device or production system can be directly accessed by the user and can be used to perform normal operations, and the auxiliary storage 106 can be used to backup data of the production system. The first backup can be performed on the auxiliary storage 106, thereby generating the first backup data 103a. Subsequently, the user can write additional data to all or part of the files in the production system. Then, if a ransomware attack occurs, the ransomware will affect all or part of the files in the production system, thereby generating a large amount of data with unknown data format. After the ransomware infection, the second backup can be performed on the auxiliary storage 106 at a time later than the time of performing the first backup data 103a, thereby generating the second backup data 103b with unknown data format. The second backup data 103b can include one or more files infected by the ransomware. The device 100 according to the present application can start the ransomware detection after the second backup is completed in the auxiliary storage, wherein the production system is no longer involved.

[0100] In an exemplary embodiment, the processor 104 is further configured to determine a difference between the first backup data 103a and the second backup data 103b based on one or more parameters of the first backup data 103a and one or more parameters of the second backup data 103b. Then, the processor 104 is configured to determine a ransomware attack on the second backup data 103b when the determined difference exceeds a preset threshold.

[0101] In the present application, determining a ransomware attack on the second backup data 103b can mean that the processor 104 is configured to determine that the probability of the second backup data 103b being attacked by the ransomware is higher than a preset threshold. For example, but not limited to, the threshold of the difference between the first backup data 103a and the second backup data 103b can be preset to 0.95, or 0.98, or 0.99, so that the processor 104 can respectively detect that the probability of the ransomware attack on the second backup data 103b is greater than 95%, or 98% or 99%. The greater the value of the preset threshold, the higher the accuracy of the ransomware detection of the device 100 on the second backup data 103b.

[0102] The difference between the first backup data 103a and the second backup data 103b determined based on one or more parameters of the first backup data 103a and one or more parameters of the second backup data 103b can refer to calculating a parameter difference between the one or more parameters of the first backup data 103a and the one or more parameters of the second backup data 103b.

[0103] In one example, the processor 104 can determine the amount of change of the first backup data 103a and the amount of change of the second backup data 103b. Then, the processor 104 can determine the difference between the amount of change of the first backup data 103a and the amount of change of the second backup data 103b. The amount of change of the second backup data 103b being greater than the amount of change of the first backup data 103a can indicate that the second backup data 103b has been attacked by ransomware. Thus, the processor 104 can determine the ransomware attack on the second backup data 103b if the calculated difference of the amount of change exceeds a preset threshold.

[0104] In another example, the processor 104 can determine the compression ratio of the first backup data 103a and the compression ratio of the second backup data 103b, and then the processor 104 can determine the difference between the compression ratio of the first backup data 103a and the second compression ratio of the second backup data 103b. The compression ratio of the second backup data 103b being smaller than the compression ratio of the first backup data 103a can indicate that the second backup data 103b is attacked by ransomware. Thus, the processor 104 can determine the ransomware attack on the second backup data 103b if the calculated difference of the compression ratio exceeds a preset threshold.

[0105] In another example, the processor 104 can determine the deduplication rate of the first backup data 103a and the deduplication rate of the second backup data 103b. Then, the processor 104 can determine the difference between the deduplication rate of the first backup data 103a and the deduplication rate of the second backup data 103b. The deduplication rate of the second backup data 103b being smaller than the deduplication rate of the first backup data 103a can indicate that the second backup data 103b is attacked by ransomware. Thus, the processor 104 can determine the ransomware attack on the second backup data 103b if the calculated difference of the deduplication rate exceeds a preset threshold.

[0106] In another example, the processor 104 can determine an entropy of the first backup data 103a and an entropy of the second backup data 103b. Then, the processor 104 can determine a difference between the entropy of the first backup data 103a and the entropy of the second backup data 103b. A larger entropy of the second backup data 103b than the entropy of the first backup data 103a can indicate that the second backup data 103b has been attacked by ransomware. Therefore, the processor 104 can determine a ransomware attack on the second backup data 103b if the calculated difference of the entropy exceeds a preset threshold.

[0107] In yet another example, the processor 104 can determine a change amount and / or a compression ratio and / or a deduplication rate and / or an entropy, or any combination thereof, of the first backup data 103a and a change amount and / or a compression ratio and / or a deduplication rate and / or an entropy, or any combination thereof, of the second backup data 103b. Then, the processor 104 can determine a difference between the one or more parameters of the first backup data 103a and the one or more parameters of the second backup data 103b, and can further determine a ransomware attack on the second backup data 103b when the determined difference exceeds a preset threshold.

[0108] The ransomware detection in the backup data with unknown data format provided in the above embodiments and examples is faster, and can be performed during the storage of the backup.

[0109] In the embodiments described below, the ransomware detection in the backup data with unknown data format requires further data analysis, and provides higher accuracy of the ransomware detection.

[0110] In one embodiment, the processor 104 is further configured to search for one or more metadata markers within the second backup data 103b. The one or more metadata markers include at least one of: a file name, a signature, a sequence of zeros, or a repeating pattern within the second backup data 103b.

[0111] When the one or more metadata markers within the second backup data 103b are detected, the processor 104 is further configured to indicate a start and an end of each entry of the second backup data 103b based on the detected one or more metadata markers, wherein each entry includes an object or a file. Then, the processor 104 is configured to split the second backup data 103b into separate entries based on the indicated start and end of each entry. In addition, for each entry of the second backup data 103b, the processor 104 is configured to determine a corresponding entry in the first backup data 103a.

[0112] The processor 104 is then configured to determine the one or more parameters in each entry of the first backup data 103a and the one or more parameters in each entry of the second backup data 103b. The processor 104 is further configured to, for each entry, determine a parameter difference based on the one or more parameters of the first backup data 103a and the one or more parameters of the second backup data 103b. The processor 104 is then configured to determine a ransomware attack on the second backup data 103b when the parameter difference exceeds a pre-set threshold.

[0113] In one example, after detecting the one or more metadata markers within the second backup data 103b, splitting the second backup data 103b into separate entries based on the indicated start and end of each entry, and for each entry, determining the corresponding entry in the first backup data 103a, the processor 104 can determine the entropy of each separate entry in the first backup data 103a and the entropy of each separate entry in the second backup data 103b. The processor 104 can further determine the difference between the entropy of an entry in the first backup data 103a and the entropy of the same entry in the second backup. This is performed for each entry of the first backup data 103a and the second backup data 103b. A larger entropy of a particular entry of the second backup data 103b than the entropy of the same entry in the first backup data 103a can indicate that the particular entry of the second backup data 103b has been subjected to a ransomware attack. Thus, the processor 104 can be configured to determine a ransomware attack on the second backup data 103b if the determined difference in entropy for an entry exceeds a pre-set threshold.

[0114] In the present embodiment, the parameter difference based on the one or more parameters of the first backup data 103a and the one or more parameters of the second backup data 103b is determined for each entry, rather than for the complete first backup data 103a and second backup data 103b. Thus, the accuracy of the ransomware detection for the second backup data 103b whose data format is unknown is enhanced, as the processor 104 can determine that the second backup data 103b has been subjected to a ransomware attack once the parameter difference determined in a single entry exceeds a pre-set threshold.

[0115] Optionally, as the present embodiment allows the second backup data 103b whose data format is unknown to be split into separate entries (i.e. files or objects), the processor 104 can be further configured to use the one or more parameters in each entry of the first backup data 103a and the one or more parameters in each entry of the second backup data 103b as input to a ransomware detection algorithm. Alternatively, the processor 104 can be further configured to use one or more separate entries of the first backup data 103a and one or more separate entries of the second backup data 103b as input to a ransomware detection algorithm.

[0116] For example, the ransomware detection algorithm can be an existing ransomware detection algorithm for known data formats. In this way, even if the second backup data 103b has an unknown data format, the present embodiment optionally allows using existing and well-known ransomware detection algorithms on a per-entry basis.

[0117] In one embodiment, once the entries in the second backup data 103b are determined, and when the entries include data files, the processor 104 is further configured to determine an entropy of each file of the file system hierarchy between snapshots of the same data volume in the first backup data 103a and the second backup data 103b; then, the processor 104 is configured to: for each file of the file system hierarchy between snapshots of the same data volume, determine an entropy difference value based on the entropy of the first backup data 103a and the entropy of the second backup data 103b. The processor 104 is further configured to analyze the entropy difference value of each file of the file system hierarchy between snapshots of the same data volume and determine a ransomware attack on the second backup data 103b based on the analyzed entropy difference value.

[0118] The analysis of the entropy difference value for each file of the file system hierarchy between snapshots of the same data volume can be performed by using a machine learning algorithm, such that for each file of the file system hierarchy between snapshots of the same data volume, the entropy of the second backup data 103b is compared to the entropy of the first backup data 103a, thereby indicating whether the second backup data 103b is subject to a ransomware attack.

[0119] In one embodiment, when no metadata tags within the second backup data 103b are detected, the processor 104 is further configured to identify a file name of each file within the second backup data 103b. The identification of the file name of each file within the second backup data 103b can be performed by using a special predefined regular expression or a machine learning algorithm. Then, the processor 104 is configured to split the second backup data 103b into individual files based on the identified file name of each file. The processor 104 is further configured to: for each file of the second backup data 103b, determine a corresponding file in the first backup data 103a.

[0120] Further, the processor 104 is configured to determine one or more parameters of the first backup data 103a in each file of the first backup data 103a and one or more parameters of the second backup data 103b in each file of the second backup data 103b. Then, the processor 104 is configured to determine, for each file, a parameter difference based on the one or more parameters of the first backup data 103a and the one or more parameters of the second backup data 103b. The processor 104 is further configured to determine a ransomware attack on the second backup data 103b when the parameter difference of one of the files exceeds a pre-set threshold.

[0121] Optionally, the processor 104 can be further configured to use the file name of each of the identified files as an input to a ransomware detection algorithm. In particular, the ransomware detection algorithm can be an existing ransomware detection algorithm for known data formats.

[0122] Optionally, the processor 104 can be further configured to use the one or more parameters in each file of the first backup data 103a and the one or more parameters in each file of the second backup data 103b as an input to a ransomware detection algorithm. In particular, the ransomware detection algorithm can be an existing ransomware detection algorithm for known data formats.

[0123] In this way, even if the entire second backup has an unknown data format, the present embodiment optionally allows using an existing ransomware detection algorithm on a per-file basis.

[0124] In one embodiment, when no metadata tags within the second backup data 103b are detected, the processor 104 is further configured to determine an entropy of the first backup data 103a. Then, the processor is configured to determine a quantity of changes of the second backup data 103b and an entropy of the quantity of changes of the second backup data 103b. The processor is further configured to determine an entropy difference based on the entropy of the first backup data 103a and the entropy of the quantity of changes of the second backup data 103b, and determine a ransomware attack on the second backup data 103b when the entropy difference exceeds a pre-set threshold.

[0125] In one embodiment, when no metadata tags within the second backup data 103b are detected, the processor 104 is further configured to search for one or more predefined signatures within the second backup data 103b. The one or more predefined signatures can uniquely identify a ransomware. Then, the processor 104 is configured to determine a ransomware attack on the second backup data 103b if the one or more predefined signatures are found within the second backup data 103b.

[0126] The device 100 can select the one or more predefined signatures by querying a database comprising mappings between a number of ransomwares and their associated signatures.

[0127] The device 100 can include and maintain its own database of ransomware. Alternatively, the device 100 can use an external ransomware database.

[0128] The ransomware detection in backup data of unknown data format provided in the present embodiment can be performed in parallel with the ransomware detection in backup data of unknown data format provided in some of the above embodiments. The parallel implementation of the disclosed embodiments provides higher accuracy in ransomware detection in backup data of unknown data format and can be used to validate the ransomware detection.

[0129] For example, when the metadata flag within the second backup data 103b is not detected, the processor 104 can be configured to search for one or more predefined signatures within the second backup data 103b, and if the one or more predefined signatures are found within the second backup data 103b, determine a ransomware attack on the second backup data 103b. Further, as a validation of the detection of the ransomware attack, the processor 104 can be further configured to identify a file name of each file within the second backup data 103b, split the second backup data 103b into individual files based on the identified file name of each file, and determine a corresponding file in the first backup data 103a for each file of the second backup data 103b. The identification of the file name of each file within the second backup data 103b can be performed by using a special predefined regular expression or a machine learning algorithm.

[0130] The processor 104 can then be configured to split the second backup data 103b into individual files based on the identified file name of each file. Further, the processor 104 can be configured to determine a corresponding file in the first backup data 103a for each file of the second backup data 103b. The processor 104 can be further configured to determine one or more parameters of the first backup data 103a in each file of the first backup data 103a, and one or more parameters of the second backup data 103b in each file of the second backup data 103b. The processor 104 can then be configured to determine a parameter difference for each file based on the one or more parameters of the first backup data 103a and the one or more parameters of the second backup data 103b. The processor 104 can be further configured to determine a ransomware attack on the second backup data 103b when the parameter difference for one of the files exceeds a pre-set threshold.

[0131] Thus, in case the file name of a particular file within the second backup data 103b is not identified, the device 100 cannot determine a ransomware attack on the second backup data 103b if the file is infected with ransomware; however, the device 100 can still determine a ransomware attack on the second backup data 103b if one or more predefined signatures are searched for and found within the second backup data 103b. Conversely, if the second backup data 103b is infected with ransomware that is not in the ransomware database, the device 100 cannot determine a ransomware attack on the second backup data 103b; however, the device 100 can still determine a ransomware attack on the second backup data 103b if the parameter difference determined based on the one or more parameters of the first backup data 103a and the one or more parameters of the second backup data 103b exceeds a pre-set threshold for each of the separated files.

[0132] Alternative examples are obtained by performing other embodiments according to the present application in parallel.

[0133] In Figure 2 In the illustrated embodiment, the processor 104 is further configured to send a warning message to the controller 102. The warning message comprises information alerting the user about the ransomware attack on the second backup data 103b. The controller 102 is further configured to communicate with a production device 108. The production device 108 is accessible by the user, and the production device 108 is configured to display the warning message to the user.

[0134] Thus, the user is prevented from further writing new data that can be susceptible to ransomware theft.

[0135] In one embodiment, the device 100 is implemented inside the secondary storage 106 or outside the secondary storage 106. Alternatively, the device 100 is implemented in a smart device that can be located inside the secondary storage 106 or outside the secondary storage 106. Alternatively, the device 100 can be implemented in a smart device outside the secondary storage 106 during the data transfer into the secondary storage system. It is noted that this can reduce the detection time of the backup data.

[0136] For example, the device 100 can be implemented inside the secondary storage 106 at a level of a deduplication segment. In this level, some information across multiple segments can be lost, but a ransomware attack on the second backup data 103b can still be detected. In this way, the performance of the implemented device 100 can be improved by a factor of 100.

[0137] In another example, the device 100 can be implemented in a smart device outside the secondary storage 106 during the data transfer into the secondary storage system.

[0138] Once a ransomware attack on the second backup data 103b is detected, the controller 102 can also be used to lock the first backup data 103a. Typically, computer systems have a retention policy that removes older backup data from secondary storage due to limited disk capacity. Therefore, in the event of a ransomware attack detected on the second backup data 103b, the first backup data 103a may not be removed from secondary storage 106 during the normal process of deleting older backup data. This older backup data may include backup data in secondary storage 106 that was generated long before the second backup data 103b. Therefore, even if user data in the second backup data 103b is lost or blocked due to a ransomware attack, users can still access at least some of the data or at least earlier versions of the data; thus, user information is not completely lost or blocked.

[0139] Figure 3 An example flowchart for ransomware detection in backup data with an unknown data format, according to the above embodiments of the present invention, is shown.

[0140] exist Figure 3 The right branch describes that when controller 102 acquires first backup data 103a and second backup data 103b, processor 104 can check whether the second backup data 103b has an unknown data format, while the first backup data 103a may have a known or unknown data format. When the second backup data 103b has an unknown data format, the processor can search for one or more metadata tags within the second backup data 103b, and when no metadata tags are detected, processor 104 can also search for one or more predefined signatures within the second backup data 103b. Then, if one or more predefined signatures are found within the second backup data 103b, processor 104 can determine that a ransomware attack has occurred on the second backup data 103b.

[0141] Additionally or alternatively, the processor 104 can also be configured to: identify a file name of each file within the second backup data 103b; split the second backup data 103b into individual files based on the identified file name of each file; for each file of the second backup data 103b, determine a corresponding file in the first backup data 103a; determine one or more parameters of the first backup data 103a in each file of the first backup data 103a and one or more parameters of the second backup data 103b in each file of the second backup data 103b; for each file, determine a parameter difference based on the one or more parameters of the first backup data 103a and the one or more parameters of the second backup data 103b, and determine a ransomware attack on the second backup data 103b when the parameter difference of one of the files exceeds a pre-set threshold. Additionally or alternatively, the processor 104 can be configured to use the identified file name of each file as an input to a ransomware detection algorithm while splitting the second backup data 103b into individual files. The ransomware detection algorithm can be an existing ransomware detection algorithm for known data formats.

[0142] In Figure 3 the example, when the second backup data 103b has a known data format, the processor can identify a file name of each file of the second backup data 103b, which can be used as an input to a ransomware detection algorithm for data formats known. This is shown in the left branch of Figure 3 Additionally or alternatively, when one or more metadata markers are detected within the second backup data 103b, the processor 104 can also be configured to: indicate a start and an end of each entry of the second backup data 103b based on the detected one or more metadata markers, wherein each entry comprises an object or a file; split the second backup data 103b into individual entries based on the indicated start and end of each entry; and for each entry of the second backup data 103b, determine a corresponding entry in the first backup data (103a). The processor can then be configured to determine one or more parameters in each entry of the first backup data 103a and one or more parameters in each entry of the second backup data 103b, and also: for each entry, determine a parameter difference based on the one or more parameters of the first backup data 103a and the one or more parameters of the second backup data 103b. The processor can also be configured to determine a ransomware attack on the second backup data 103b when the parameter difference exceeds a pre-set threshold.

[0143] Alternatively, also in Figure 3In the left branch, the processor 104 can be configured to determine the entropy of each file of the file system hierarchy between snapshots of the same data volume in the first backup data 103a and the entropy of each file of the file system hierarchy between snapshots of the same data volume in the second backup data 103b; determine, for each file of the file system hierarchy between snapshots of the same data volume, an entropy difference value based on the entropy of the first backup data 103a and the entropy of the second backup data 103b; and analyze the entropy difference values of each file of the file system hierarchy between snapshots of the same data volume and determine, based on the analyzed entropy difference values, a ransomware attack on the second backup data 103b.

[0144] The device 100 can comprise processing circuitry (not shown) configured to perform, conduct or initiate the various operations of the device 100 herein. The processing circuitry can comprise hardware and software. The hardware can comprise analog circuitry or digital circuitry, or both analog circuitry and digital circuitry. The digital circuitry can comprise components such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), or multi-purpose processors, etc. In one embodiment, the processing circuitry comprises one or more processors and a non-transitory memory connected to the one or more processors. The non-transitory memory can carry executable program code which, when executed by the one or more processors, causes the device 100 to perform, conduct or initiate the operations or methods described herein.

[0145] Figure 4 Steps of a method 200 for ransomware detection in backup data of unknown data format according to embodiments of the application are shown. Specifically, the method 200 is performed by the device 100 as described above.

[0146] The method 200 comprises a step S202 of obtaining, from the secondary storage, first backup data 103a and second backup data 103b, wherein the second backup data 103b is generated later than the first backup data 103a in the secondary storage. The second backup data 103b has an unknown data format, and the first backup data 103a has a known data format or an unknown data format.

[0147] The method 200 further comprises a step S204 of detecting, based on one or more parameters of the first backup data 103a and one or more parameters of the second backup data 103b, a ransomware attack on the second backup data 103b.

[0148] The one or more parameters of the first backup data 103a indicate at least one of a change amount, a compression ratio, a deduplication rate, an entropy, or a predefined signature of the first backup data 103a. The one or more parameters of the second backup data 103b indicate at least one of a change amount, a compression ratio, a deduplication rate, an entropy, or a predefined signature of the second backup data 103b.

[0149] The method 200 can also comprise the actions of the above described embodiments of the device 100. Thus, the method 200 achieves the same advantages as the device 100.

[0150] The application also provides a computer program product comprising program code which, when implemented on a processor, performs the method 200 as shown. The computer program can be comprised in a computer readable medium of the computer program product. The computer readable medium can essentially comprise any memory, such as a read-only memory (ROM), a programmable read-only memory (PROM), an erasable PROM (EPROM), a flash memory, an electrically erasable PROM (EEPROM), or a hard drive. Figure 4

[0151] The application has been described in relation to various embodiments and implementations as examples. However, other variants can be understood and obtained by those skilled in the art by practicing the claimed matter, studying the figures, the application, and the independent claims. In the claims and in the description, the word "comprising" does not exclude other elements or steps, and the word "a" or "an" does not exclude a plurality. A single element or other unit can fulfill the functions of several entities or items listed in the claims. The mere fact that measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.​

Claims

1. A device (100) for detecting ransomware in backup data with an unknown data format, characterized in that, The device (100) includes: A controller (102) is configured to obtain first backup data (103a) and second backup data (103b) from auxiliary storage (106), wherein the second backup data (103b) is generated in the auxiliary storage (106) later than the first backup data (103a), wherein the second backup data (103b) has an unknown data format, and wherein the first backup data (103a) has a known data format or an unknown data format; and The processor (104) is configured to detect ransomware attacks on the second backup data (103b) based on one or more parameters of the first backup data (103a) and one or more parameters of the second backup data (103b); Wherein, the one or more parameters of the first backup data (103a) indicate at least one of the following: amount of change, compression ratio, deduplication rate, entropy, or predefined signature; and The parameters of the second backup data (103b) indicate at least one of the following: amount of change, compression ratio, deduplication rate, entropy, or predefined signature.

2. The device (100) according to claim 1, characterized in that, The processor (104) is also used for: The difference between the first backup data (103a) and the second backup data (103b) is determined based on one or more parameters of the first backup data (103a) and one or more parameters of the second backup data (103b); as well as When the determined difference exceeds a preset threshold, a ransomware attack on the second backup data (103b) is determined.

3. The device (100) according to claim 1, characterized in that, The processor (104) is also used for: Search for one or more metadata tags within the second backup data (103b); The one or more metadata tags include at least one of the following: filename, signature, zero sequence, and repeat pattern in the second backup data (103b).

4. The device (100) according to claim 3, characterized in that, When the processor (104) detects one or more metadata tags within the second backup data (103b), it is further configured to: The start and end of each entry of the second backup data (103b) are indicated based on one or more detected metadata tags, wherein each entry includes an object or a file; The second backup data (103b) is split into separate entries based on the start and end of each indicated entry; and For each entry in the second backup data (103b), determine the corresponding entry in the first backup data (103a).

5. The device (100) according to claim 4, characterized in that, The processor (104) is also used for: Determine one or more parameters in each entry of the first backup data (103a) and one or more parameters in each entry of the second backup data (103b); For each entry, a parameter difference is determined based on one or more parameters of the first backup data (103a) and one or more parameters of the second backup data (103b); as well as When the parameter difference exceeds a preset threshold, a ransomware attack on the second backup data (103b) is determined.

6. The device (100) according to claim 4, characterized in that, The processor (104) is also used for: Determine the entropy of each file at the file system level between snapshots of the same data body in the first backup data (103a), and the entropy of each file at the file system level between snapshots of the same data body in the second backup data (103b); For each file in the file system hierarchy between snapshots of the same data body, the entropy difference is determined based on the entropy of the first backup data (103a) and the entropy of the second backup data (103b); as well as Analyze the entropy difference of each file in the file system hierarchy between snapshots of the same data body, and determine a ransomware attack on the second backup data (103b) based on the analyzed entropy difference.

7. The device (100) according to claim 3, characterized in that, When no metadata tag is detected in the second backup data (103b), the processor (104) is further configured to: Use regular expressions or machine learning algorithms to identify the filename of each file within the second backup data (103b); The second backup data (103b) is split into separate files based on the filename of each identified file; For each file in the second backup data (103b), determine the corresponding file in the first backup data (103a); Determine one or more parameters of the first backup data (103a) in each file of the first backup data (103a), and one or more parameters of the second backup data (103b) in each file of the second backup data (103b); For each file, a parameter difference is determined based on one or more parameters of the first backup data (103a) and one or more parameters of the second backup data (103b), and When the parameter difference of one of the files exceeds a preset threshold, a ransomware attack on the second backup data (103b) is determined.

8. The device (100) according to claim 3, characterized in that, When no metadata tag is detected in the second backup data (103b), the processor (104) is further configured to: Determine the entropy of the first backup data (103a); Determine the amount of change to the second backup data (103b), and determine the entropy of the amount of change to the second backup data (103b); The entropy difference is determined based on the entropy of the first backup data (103a) and the entropy of the amount of change in the second backup data (103b). When the entropy difference exceeds a preset threshold, a ransomware attack on the second backup data (103b) is determined.

9. The device (100) according to any one of claims 5 or 7, characterized in that, The processor (104) is also used for: The one or more parameters in each entry of the first backup data (103a) and the one or more parameters in each entry of the second backup data (103b), or the one or more parameters in each file of the first backup data (103a) and the one or more parameters in each file of the second backup data (103b), are used as inputs to the ransomware detection algorithm.

10. The device (100) according to claim 3, characterized in that, When no metadata tag is detected in the second backup data (103b), the processor (104) is further configured to: Search for one or more predefined signatures within the second backup data (103b); and If one or more predefined signatures are found in the second backup data (103b), a ransomware attack on the second backup data (103b) is determined.

11. The device (100) according to any one of claims 1 to 8, characterized in that: The processor (104) is also configured to send a warning message to the controller (102), wherein the warning message includes information reminding the user of a ransomware attack on the second backup data (103b); and The controller (102) is also configured to communicate with the production equipment (108), which is accessible to the user, and the production equipment (108) is configured to display the warning message to the user.

12. The device (100) according to any one of claims 1 to 8, characterized in that, The device (100) is implemented inside or outside the auxiliary storage (106), or the device (100) is implemented in a smart device located inside or outside the auxiliary storage (106).

13. A method (200) for detecting ransomware in backup data with an unknown data format, characterized in that, The method includes: (S202) Obtain first backup data (103a) and second backup data (103b) from auxiliary storage, wherein the second backup data (103b) was generated in the auxiliary storage later than the first backup data (103a), wherein the second backup data (103b) has an unknown data format, and wherein the first backup data (103a) has a known data format or an unknown data format; and Detect (S204) ransomware attacks on the second backup data (103b) based on one or more parameters of the first backup data (103a) and one or more parameters of the second backup data (103b); Wherein, the one or more parameters of the first backup data (103a) indicate at least one of the following: amount of change, compression ratio, deduplication rate, entropy, or predefined signature; and The parameters of the second backup data (103b) indicate at least one of the following: amount of change, compression ratio, deduplication rate, entropy, or predefined signature.

14. A computer program product, characterized in that, The computer program product includes program code that, when executed in a processor, performs the method according to claim 13.

Images