Patent ID: 8533818

Claim:
A method for mitigating a network security threat comprising: receiving at a first device, from a backup agent on a client device, backup metadata associated with a data protection event, wherein the received backup metadata is indicative of a change in data of the client device to be backed up, and wherein the first device is configured to receive metadata separate from client backup data; storing at the first device backup metadata, wherein the backup metadata is stored in a memory location separate from client backup data; evaluating, using a processor of the first device, the received backup metadata for an indication of a network security threat at the client device, wherein evaluating the received backup metadata for an indication of a network security threat at the client device includes at least one of: determining whether a host is making more frequent changes to data, wherein the host has previously made less frequent changes to data; detecting an absence of an expected indication of a modification in the received backup metadata; identifying based on backup metadata from a plurality of client devices an indication of copies of an identical file created within a specified period of time; an expected change in a size of a file modification; a modification to a file not expected to be modified; identifying based on backup metadata from a plurality of client devices a modification to a same file across several client devices; determining that a current backup activity deviates by more than a threshold amount from a corresponding previously-observed backup activity; and determining that a host that in the past has made only few changes to data has begun to make more frequent changes to data; and performing one or more remedial actions if a network security threat is detected.