Patent ID: 11941117
Assignee: RUBRIK, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 8:
9. A system of comprising:
at least one hardware processor; and
a non-transitory computer-readable medium storing executable instructions that, when executed, cause the at least one hardware processor to perform operations comprising:
generating a first prediction that a file system comprising a plurality of files has been attacked by ransomware based on snapshot metadata of the file system using a snapshot-level machine learning prediction model, the snapshot metadata comprising a plurality of file change data indicating a plurality of file change events that have been performed on the file system;
in response to the first prediction that the file system has been attacked by the ransomware using the snapshot-level machine learning prediction model, generating a corresponding classification for each one of the plurality of files in the file system based on the plurality of file change data using a file-level machine learning prediction model that is different from the snapshot-level machine learning prediction model, the corresponding classification indicating whether the corresponding one of the plurality of files has been targeted by the ransomware for encryption;
determining that one or more of the plurality of files have been targeted by the ransomware for encryption based on the corresponding classification for each one of the one or more of the plurality of files; and
causing the corresponding classification for each one of the one or more of the plurality of files to be displayed on a computing device of a user.