Ransomware detection

NGBackup watches your data in real time and reacts to ransomware as it happens — not after the backup fails.

Active detection

A File-Daemon sentinel monitors the filesystem and flags attacks using multiple signals:

• Shannon entropy spikes (mass encryption looks random).
• Burst renames and suspicious extensions.
• Altered-ratio thresholds across a tree.

Automatic response

When an attack is detected, NGBackup can take any of nine configurable response actions — from raising a high-priority alert and tagging the job, to pausing backups so a poisoned copy never overwrites a good one. Your clean, immutable backups survive the attack.

Incremental Accelerator

The same plugin includes an Incremental Accelerator that skips the File Daemon’s full tree-walk on Linux — reading the filesystem’s own change journal instead of re-scanning every file — so incrementals run up to 3× faster on large filesystems. The gain scales with your change ratio: the more files that stay unchanged between backups, the bigger the speed-up. Detection that also speeds up everyday backups.

Pre-restore malware scanning (ClamAV / YARA)

Backup-time detection is only half of the story: a recovery point captured before an attack was detected may still carry the malware. The granular-restore engine therefore supports scanning recovery points at restore time, before any data is handed back:

• ClamAV (signature-based) — via clamdscan (daemon) or clamscan; signature freshness is handled by ClamAV’s own freshclam auto-update.
• YARA (rule-based) — runs your organization’s rule sets recursively, enabling custom IOC hunting inside backups.

Exporters scan the content before publishing a granular-restore share. Flagged content is quarantined instead of delivered — the operator receives the detection report, not the infected files. The engine is unsafe-by-default on errors: if the scanner cannot run, the share is not published. ClamAV and/or YARA must be installed on the host running the granular-restore engine; air-gapped sites can mirror the ClamAV database internally.

Combined with the backup-time sentinel, this covers the pipeline with both behavioral/heuristic and signature-based detection — during backup and again before restore.

See the Ransomware Detection plugin page for the full option list, and pair it with Immutability / WORM.