Patent ID: 11886606
Assignee: DATTO, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 21:
22. A backup system, comprising:
an electronic processor operatively connected with a cloud data storage; and one or more non-transitory computer-readable storage media configured to store:
backup instructions readable and executable by the electronic processor to perform an incremental or differential backup of a system of folders or directories of a computer or network of computers via an electronic network;
ransomware attack (RWA) detection instructions readable and executable by the electronic processor to perform RWA detection operations including: processing incremental or differential backup metadata acquired during the incremental or differential backup to determine whether a RWA alert is issued wherein the processing does not use the file content; and performing RWA remediation including at least disabling the computer or network of computers via the electronic network based at least in part on the RWA alert being issued;
wherein the processing of the incremental or differential backup metadata to determine whether a RWA alert is issued includes:
processing the incremental or differential backup metadata to identify one or more folders or directories that contain candidate new files and candidate deleted files in which the candidate new files are candidates for being encrypted copies of the candidate deleted files, the candidate new and deleted files being identified without using file content; and
issuing the RWA alert based at least in part on at least one folder or directory containing candidate new and candidate deleted files meeting a RWA alert criterion.