Pure Storage, Inc.
Filesystem Property Based Determination of a Possible Ransomware Attack Against a Storage System

Abstract:

An illustrative method includes a data protection system identifying a first attribute set associated with a first file stored in a storage system, determining that the first file is replaced in the storage system with a second file, identifying a second attribute set associated with the second file, and determining, based on the determining that the first file is replaced in the storage system with the second file and on one or more attributes in at least one of the first attribute set or the second attribute set, that data stored by the storage system is possibly being targeted by a security threat.