Abstract: The Back Up Data Across Cloud Trust Zone Apparatuses, Processes and Systems (“BUDACTZ”) transforms resource backup registration input, resource backup execution request, resource restore input datastructure/inputs via BUDACTZ components into resource backup registration output, resource backup execution response, resource restore output outputs. A resource backup registration datastructure structured to specify a partner shared cloud protected zone is obtained. A partner zone administrator authorization token datastructure is obtained. A partner zone service account for the partner shared cloud protected zone is created using the partner zone administrator authorization token datastructure. A partner zone resource to be serviced is determined. A shared cloud backup zone is determined. A backup resource for the partner zone resource is created in the shared cloud backup zone. A service agent installation token datastructure structured to associate the partner zone resource and the backup resource is generated.

Abstract: Described screenshot verification systems and methods for automatically verifying the integrity of a backup image or other process-of-interest using a screenshot verification system, as well as disaster recovery systems including said systems and performing said methods. In accordance with various aspects of the present disclosure, a virtual machine is booted and screenshots of the boot process are taken, which are used by a trained model, such as a convolutional neural network, to determine a boot state consistency. The systems and methods described deliver over 99% accuracy and do not involve regular expression analysis typical of conventional methods.

Abstract: Ransomware attack (RWA) detection is performed during an incremental or differential backup of a system of folders or directories of a computer or network of computers via an electronic network. The RWA detection includes processing incremental or differential backup metadata acquired during the incremental or differential backup to determine whether a RWA alert is issued. RWA remediation is performed at least in part on the RWA alert being issued. The RWA alert may be issued based on processing of the incremental or differential backup metadata to identify candidate new files and candidate deleted files in which the candidate new files are candidates for being encrypted copies of the candidate deleted files. RWA alert criterion may be based on counts of new versus deleted files in a folder or directory, and comparison of file sizes of the new versus deleted files.

Abstract: The Multi-Client Backup Deduplication Apparatuses, Methods and Systems (“MCBD”) transforms backup request, restore request, virtual machine initialization request inputs via MCBD components into backup response, restore response, virtual machine initialization response outputs. A backup request identifying a source volume is obtained. The source volume's master file table is retrieved and a file entry is selected. File data runs associated with the selected entry are determined. The file is reassembled in a buffer and split into file chunks Upon determining that a file chunk is not indexed in a chunk index, the file chunk is stored on a target volume and indexed in the chunk index. File chunk slice datastructures that map source volume offset location of file data on the source volume to the corresponding file chunk offset location of that file data in the file chunk on the target volume are generated and stored in a manifest file.

Abstract: A method facilitating business continuity of an enterprise computer network includes receiving an initiate network recovery message at a disaster recovery orchestration platform identifying an enterprise computer network to be recovered. Predetermined network configuration information associated with the enterprise computer network is retrieved from a storage device accessible to the disaster recovery orchestration platform. A virtual recovered enterprise network is built in a virtual computing environment based at least in part on the predetermined network configuration information. A system to facilitate business continuity of an enterprise computer network is also provided. The system includes a disaster recovery orchestration platform, a storage device, and at least one communication interface. The disaster recovery orchestration platform including at least one platform computing device. Each platform computing device including at least one processor and associated memory.

Abstract: This disclosure and the exemplary embodiments described herein, provide methods and systems for detecting a ransomware infection in one or more files. According to an exemplary embodiment, a low frequency encryption analysis and a high frequency encryption analysis of a plurality of received files is performed to determine if the one or more of the files are encrypted. If a file is encrypted, a watcher is utilized to monitor file events associated with the files for determining if one or more of the files are infected with ransomware.

Abstract: A method for generating a crash-consistent backup of a source volume includes designating certain blocks of an operating source volume to be copied to a target volume, copying the designated blocks from the source volume to the target volume; initiating a time-based tracking process and detecting writes to blocks of the source volume. Using the time-based tracking process to maintain a time-ordered list of blocks that are written to during the copying of blocks to the target volume and to determine when the blocks on the target volume are in a sane state that permits a crash-consistent backup. After the designated blocks are copied, using the time-ordered list to continue copying blocks to the target volume. After the time-tracking process determines the blocks on the target volume are crash consistent (i.e., in a sane state), a snapshot can be transferred to a backup volume and time-tagged as a crash-consistent backup.

Abstract: Ransomware detection and/or isolation and/or remediation of a ransomware-encryption device is performed in a Remote Monitoring and Management (RMM) system environment. The RMM system is operatively associated with monitoring and managing a plurality of devices and, according to an exemplary embodiment, the RMM system includes a RMM agent module locally installed on each device, a cloud-based RMM platform operatively communicating with each device RMM agent module, and a Ransomware Detection (RD)/Isolation module locally installed on each device. The RD/Isolation module locally detects a potential ransomware-encryption in one or more files received by the device and the RMM system isolates a ransomware affected device using a locally executed script provided by the cloud-based RMM platform.

Abstract: A system for managing and controlling a mesh VPN includes a management computing platform, a control computing platform, teleworker computing subsystems, and an office computing subsystem. The management computing platform provides deployment and management services to an organization for operation of a mesh VPN in a WAN in accordance with a service profile. The mesh VPN includes a hub node and a plurality of end nodes. Each end node communicates with the VPN hub node and with other end nodes via peer-to-peer paths. The control computing platform is the hub node and provide a control service for operation of the mesh VPN based on the service profile. The teleworker and office computing subsystems are end nodes. Various methods for operation of the computing platforms and subsystems in the mesh VPN are also provided.

Abstract: Described screenshot verification systems and methods for automatically verifying the integrity of a backup image or other process-of-interest using a screenshot verification system, as well as disaster recovery systems including said systems and performing said methods. In accordance with various aspects of the present disclosure, a virtual machine is booted and screenshots of the boot process are taken, which are used by a trained model, such as a convolutional neural network, to determine a boot state consistency. The systems and methods described deliver over 99% accuracy and do not involve regular expression analysis typical of conventional methods.

Abstract: Ransomware attack (RWA) detection is performed during an incremental or differential backup of a system of folders or directories of a computer or network of computers via an electronic network. The RWA detection includes processing incremental or differential backup metadata acquired during the incremental or differential backup to determine whether a RWA alert is issued. RWA remediation is performed at least in part on the RWA alert being issued. The RWA alert may be issued based on processing of the incremental or differential backup metadata to identify candidate new files and candidate deleted files in which the candidate new files are candidates for being encrypted copies of the candidate deleted files. RWA alert criterion may be based on counts of new versus deleted files in a folder or directory, and comparison of file sizes of the new versus deleted files.

Abstract: Ransomware attack (RWA) detection is performed during an incremental or differential backup of a system of folders or directories of a computer or network of computers via an electronic network. The RWA detection includes processing incremental or differential backup metadata acquired during the incremental or differential backup to determine whether a RWA alert is issued. RWA remediation is performed at least in part on the RWA alert being issued. The RWA alert may be issued based on processing of the incremental or differential backup metadata to identify candidate new files and candidate deleted files in which the candidate new files are candidates for being encrypted copies of the candidate deleted files. RWA alert criterion may be based on counts of new versus deleted files in a folder or directory, and comparison of file sizes of the new versus deleted files.

Abstract: A system for managing and controlling a mesh VPN includes a management computing platform, a control computing platform, teleworker computing subsystems, and an office computing subsystem. The management computing platform provides deployment and management services to an organization for operation of a mesh VPN in a WAN in accordance with a service profile. The mesh VPN includes a hub node and a plurality of end nodes. Each end node communicates with the VPN hub node and with other end nodes via peer-to-peer paths. The control computing platform is the hub node and provide a control service for operation of the mesh VPN based on the service profile. The teleworker and office computing subsystems are end nodes. Various methods for operation of the computing platforms and subsystems in the mesh VPN are also provided.

Abstract: The disclosure provides methods and systems to perform data backups of protected data. According to an embodiment, a nominal backup schedule is received, and a time differential between the nominal backup schedule and a current time metric is determined. If the time differential is greater than a threshold, the backup schedule is modified so that times indicated in the modified backup schedule are at a higher frequency than a frequency of the indicated times of the nominal backup schedule. In another embodiment, if a reliability metric is greater than a corresponding threshold, the backup schedule is modified so that times indicated in the modified backup schedule are at a higher frequency than a frequency of the indicated times of the nominal backup schedule.

Abstract: This disclosure and the exemplary embodiments described herein, provide methods and systems for detecting a ransomware infection in one or more files. According to an exemplary embodiment, a low frequency encryption analysis and a high frequency encryption analysis of a plurality of received files is performed to determine if the one or more of the files are encrypted. If a file is encrypted, a watcher is utilized to monitor file events associated with the files for determining if one or more of the files are infected with ransomware.

Abstract: Ransomware attack (RWA) detection is performed during an incremental or differential backup of a system of folders or directories of a computer or network of computers via an electronic network. The RWA detection includes processing incremental or differential backup metadata acquired during the incremental or differential backup to determine whether a RWA alert is issued. RWA remediation is performed at least in part on the RWA alert being issued. The RWA alert may be issued based on processing of the incremental or differential backup metadata to identify candidate new files and candidate deleted files in which the candidate new files are candidates for being encrypted copies of the candidate deleted files. RWA alert criterion may be based on counts of new versus deleted files in a folder or directory, and comparison of file sizes of the new versus deleted files.

Abstract: Disclosed is a method and system method for bulk copying data from a cell grid to a workspace memory, such as a clipboard. According to an exemplary embodiment of this disclosure, the method includes displaying, in a user interface, a plurality of cell rows and a plurality of cell columns arranged in a grid form, a user selecting a plurality of rows of cell entries by selecting a respective selector indicator of all rows to be copied, the selected plurality of rows including a subset of a total number of rows displayed and a noncontinuous group of sequential rows where at least one nonselected row is located and displayed between two selected rows; and displaying, in the user interface, a drop-down menu including a plurality of user selectable options, the user selectable options including a user selectable command to copy the plurality of selected rows and a common predetermined subset of the associated column entries to a workspace memory such as a clipboard.

Abstract: A first entity stores an issuer digital certificate published by a certificate authority (CA) and signed by the issuer certificate; and also stores an old issuer digital certificate published by the CA prior to publication of the issuer digital certificate and an old first entity digital certificate signed by the old issuer digital certificate. The first entity attempts to initiate a secure communication session with a second entity by receiving a second entity digital certificate from the second entity via an electronic network, and sending either the first entity digital certificate or the old first entity digital certificate to the second entity based on which of the issuer digital certificate or the old issuer digital certificate is effective to authenticate the second entity digital certificate received from the second entity. The secure communication session is conducted only if the attempt to initiate the secure communication session is successful.

Abstract: The Source Volume Backup with Predictive and Lookahead Optimizations Apparatuses, Methods and Systems (“SVBAF”) transforms backup request inputs via SVBAF components into backup response outputs. A set of blocks to be copied from a source volume to a target volume is designated based on predictive optimization settings and copied based on lookahead optimization settings while an operating system is configured to write to the source volume. Blocks of the source volume that were written to by the operating system are identified. A determination is made whether to enter a CoW mode. If the CoW mode should not be entered, the designated set of blocks is changed to include at least one of the identified blocks and a pass is repeated. Otherwise, the operating system is instructed to enter the CoW mode and bring the target volume into a state consistent with a state of the source volume.

Abstract: The Prioritization and Source-Nonspecific Based Virtual Machine Recovery Apparatuses, Methods and Systems (“MBR”) transforms backup configuration request, restore request inputs via MBR components into backup configuration response, restore response outputs. A backup configuration request to configure backups of a data storage volume of a source device is obtained. A paired backup device is determined. A recovery prioritization index is generated by determining a recovery priority ranking for each selected for backup data block of the data storage volume. A discrepancy hash for each selected for backup data block of the data storage volume that is available from at least one of a set of source-nonspecific locations is precalculated. The recovery prioritization index and the discrepancy hashes are periodically updated to account for data block use. Backup data including at least one of the recovery prioritization index and the discrepancy hashes is sent from the source device to the backup device.