Backup Change Classification for Early Data Loss Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data management systems lack effective methods to automatically detect and classify data loss events such as destruction, corruption, malicious encryption, and accidental deletion by analyzing characteristics of backups and restore operations.
Innovation Solution
A method and system that collect and analyze characteristics of backup and restore operations to train a model for classifying data changes as valid or damaged, generating alerts for potential data loss events by extracting features from backup and restore operations, and applying a neural network model to classify data integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a model is trained using restore operations to classify data loss events, then classification accuracy is improved, but the time required for training and model deployment increases
Solution Approach 1:
The system performs preliminary training of the classification model using historical restore operation data before actual data loss detection is needed. This preliminary action allows the model to be pre-trained and ready for immediate use when data loss events occur, eliminating the need for real-time training and reducing detection time.
Solution Approach 2:
The system creates a copy of the training model that can be deployed independently. The trained model parameters and structure are copied to enable rapid classification of new data loss events without requiring retraining, thus maintaining high accuracy while reducing time requirements for new classifications.
2Difficulty of detecting and measuring
If backup operations are analyzed to detect data loss events, then detection capability is improved, but system complexity increases
Solution Approach 1:
The system extracts only the essential features from backup operations that are relevant for detecting data loss events. By selecting and extracting only the necessary characteristics (such as changes in data characteristics, metadata modifications, and restore operation patterns), the system reduces complexity while maintaining strong detection capability.
Solution Approach 2:
The classification model acts as an intermediary between the complex backup operation data and the detection output. This intermediary layer simplifies the system by encapsulating the complexity of data processing within the model, allowing simple input-output interfaces for detecting data loss events without exposing the underlying complexity.
3Loss of time
If real-time classification of backup changes is implemented, then response time to data loss events is reduced, but computational resources required increase
Solution Approach 1:
The classification model is trained in advance using historical data, preparing it to perform rapid real-time classifications. This preliminary training allows the model to make quick decisions during actual data loss events without requiring intensive computational resources at the time of detection, thus reducing response time while minimizing real-time computational overhead.
Solution Approach 2:
The system replaces complex real-time analysis mechanisms with a pre-trained neural network model that uses efficient pattern recognition. This substitution reduces the computational burden during real-time operation by leveraging the pre-learned patterns from training data, enabling fast classification with lower resource consumption compared to real-time learning approaches.
Data Source
AI summary
A method, including collecting, during a time period, characteristics of backup operations performed on information sources from a primary system to respective backups on a backup system and multiple restores in which one or more of the sources in the primary system are restored to a state of one of the backups, the restores having associated operations. Backup features are extracted from the characteristics for each backup, and for each given restore, restore features are extracted from the characteristics. training, based on the backup features and the restore features, a model is trained for classifying a given change to the information as including only valid or damaged information. Subsequent to the period, an additional backup is detected. Additional backup features are extracted from the additional backup, and the model is applied to the additional backup features. Finally, an alert is generated upon the model classifying the additional changes as damaged.