Abstract: A method provides a set of computer data statistical profiles derived from a corresponding set of samples of computer data to a ransomware detection system and obtains a prediction of the likelihood of a ransomware attack in the set of samples of computer data. The system utilizes a machine learning system trained to achieve data models, with each model trained initially on a corresponding cluster of curated computer data statistics profiles, each cluster including statistics characterizing a corresponding cluster of curated samples resulting from exposing a selection of raw data samples to processing by actual ransomware. Each model is subject to iterations against initial validation data until performance convergences, with sample sources from the same backups not being present in both training and validation models. The models have been subject to final validation against actual customer data to address data drift that would otherwise result in excessive false predictions.

Abstract: Methods and apparatus are disclosed that permit the transparent bridging of a broad range of backup storage devices, such that backup software will identify an intermediate device as a one of those storage devices and will transparently send their backup data-stream thereto as part of the existing standard backup process. Upon receipt of a backup data-stream from the backup software, the methods and apparatus provide for analysis of the data elements in the data-stream, collection of management information about those data elements, and storage of the management information in an easily accessible format for subsequent review and query by users and administrators of the original data. The same backup data-stream is stored on any standard backup storage device, including the imitated backup storage device.