Patent ID: 11886606
Assignee: DATTO, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. A method, comprising:
receiving incremental or differential backup metadata for a computer or network of computers via an electronic network, the incremental or differential backup metadata identifying files of the computer or network of computers which are new, modified, or deleted since a last incremental or last full backup of the computer or network of computers;
extracting file metadata from the received incremental or differential backup metadata for the files which are new or deleted since the last incremental or last full backup of the computer or network of computers;
identifying candidate new files and candidate deleted files in which the candidate new files are candidates for being encrypted copies of the candidate deleted files, the candidate new files and the candidate deleted files being identified using the extracted file metadata;
generating a ransomware attack (RWA} alert if the identified candidate new files and the candidate deleted files meet a RWA alert criterion computed using the extracted file metadata; and
performing RWA remediation including at least disabling the computer or network of computers via the electronic network in response to the RWA alert.