A Semantic-Aware File Metadata Generation Framework for Disk-Level Anomaly Detection in Virtual Machine Backups

The fast growth of Virtual Machine (VM) backup systems in cloud and enterprise environments has greatly led to exposures to disk-level anomalies brought about by ransomware and malicious data corruption. The currently used anomaly detectors are mainly content-based scanning or coarse-grained metadata analysis, which causes high computational complexity, slow response time, and an inability to scale to large-scale backup settings. To combat the above difficulties, a Semantic-Aware File Metadata Generation Framework (SA-FMGF) will be put forward in this paper to provide efficient and proactive file-level anomaly detection in a VM backup system. The framework proposed will use file-system and disk-level metadata only and will not require raw file content analysis. It will not lose detection ability or have them detects be interpreted. SA-FMGF represents compressed metadata, such as semantic metadata vectors, that are continuously being scored by lightweight unsupervised anomaly scoring systems to identify anomalies in the normal disk behaviour.