Change Block and Extent Mapping for In-Line Backup Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data protection systems lack efficient methods to detect anomalies, such as malware and ransomware, during backup operations, relying solely on change block tracking which provides limited information about the state of the computing system.
Innovation Solution
Incorporating file system metadata and extent information with change block tracking to identify changed blocks within specific files, enabling anomaly detection through application validation, entropy measurement, and malware detection, and allowing in-line anomaly detection without re-reading entire files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If change block tracking is used to identify changed blocks for backup, then backup efficiency is improved by copying only changed blocks, but anomaly detection capability deteriorates due to limited information about file context and state
Solution Approach 1:
The patent combines change block tracking with file system metadata (extents, file names, block positions) to create a hybrid approach that maintains backup efficiency while enabling anomaly detection. The CBT bitmap identifies changed blocks, and when overlaid with extent information from the file system, it provides both speed and contextual awareness for detecting anomalies like ransomware.
Solution Approach 2:
The patent introduces file system metadata (extents, block mappings, file names) as an intermediary layer between the block device and the backup/anomaly detection system. This intermediary provides the missing contextual information about which blocks belong to which files and their positions, enabling anomaly detection without sacrificing CBT efficiency.
2Measurement precision
If entire files are re-read for anomaly detection, then detection accuracy is improved, but resource consumption and time increase significantly
Solution Approach 1:
The patent extracts only the necessary subset of data (changed blocks identified by CBT) from the full file system for anomaly detection. By using the CBT bitmap to identify specifically which blocks have changed, the system performs anomaly detection only on those blocks rather than re-reading entire files, thus maintaining detection accuracy while dramatically reducing resource consumption.
Solution Approach 2:
The patent applies partial action by performing anomaly detection only on the changed blocks identified by CBT rather than on all blocks or entire files. This partial approach is sufficient for detecting anomalies since anomalies typically manifest in changed data, and it avoids the excessive resource consumption of full file re-reading.
3Measurement precision
If file system metadata is incorporated with change block tracking, then anomaly detection accuracy is improved through contextual information, but system complexity increases
Solution Approach 1:
The patent segments the anomaly detection process into distinct components: CBT bitmap generation, extent information retrieval, block-to-file mapping, and anomaly analysis. This segmentation allows each component to be optimized independently and processed in a pipeline fashion, reducing overall system complexity while maintaining high detection accuracy through the combination of metadata and changed blocks.
Data Source
AI summary
Anomaly detection in data protection operations is disclosed. During a data protection operation, blocks being backed up are sorted and associated with metadata including file system metadata. Anomaly detection operations are performed using the metadata to detect anomalies. More specifically, the blocks are evaluated or analyzed using one or more types of anomaly detection. Remediation actions are performed in response to detected anomalies.