US 10,055,582 B1Granted

Automated detection and remediation of ransomware attacks involving a storage device of a computer network

AssigneeEMC IP Holding Company LLC

InventorsJames L. Weaver, Izar Tarandach, Haral Tsitsivas, Srinivasa Maguluri

Life of this patent

Estimating the term…

Loading patent…

Abstract

An apparatus in one embodiment comprises a security appliance having a processor coupled to a memory. The security appliance is associated with at least one storage device and comprises a ransomware detector configured to generate a detection score for one or more sets of files stored in the storage device. The ransomware detector comprises a file analyzer configured to compare characteristics relating to a current state of the files with information stored in a file history database, and a detection score generator having a weighting module for applying weights to respective comparison results from the file analyzer in generating the detection score for the one or more sets of files. The ransomware detector is further configured to generate an alert if the detection score for the one or more sets of files exceeds a specified threshold. The alert may be transmitted by the security appliance to a network security system.

Claims20

Dependent claims

An apparatus comprising:

a security appliance comprising a processor coupled to a memory;
the security appliance being associated with at least one storage device;
wherein the security appliance comprises a ransomware detector configured to generate a detection score for one or more sets of files stored in the storage device;
the ransomware detector comprising:
a file analyzer for comparing characteristics relating to a current state of the files with information stored in a file history database, the information stored in the file history database comprising characteristics relating to a previous state of the files prior to a time associated with the current state, the characteristics comprising for a first one of the one or more sets of files at least one of metadata of at least one file of the first set, a relationship of at least one file of the first set to one or more other files, and a rate of change of multiple files of the first set;
and
a detection score generator having a weighting module for applying weights to respective comparison results from the file analyzer in generating the detection score for the one or more sets of files;
a given one of the comparison results from the file analyzer comprising a result of comparing a particular one of the characteristics for the current state of one or more designated ones of the files with the particular characteristic for the previous state of the one or more designated ones of the files;
wherein the ransomware detector is further configured to generate an alert if the detection score for the one or more sets of files exceeds a specified threshold.

6 more elements

A method comprising:

associating a security appliance with at least one storage device;
configuring a ransomware detector in the security appliance;
generating a detection score in the ransomware detector for one or more sets of files stored in the storage device;
and
generating an alert if the detection score for the one or more sets of files exceeds a specified threshold;
wherein generating the detection score comprises:
comparing characteristics relating to a current state of the files with information stored in a file history database, the information stored in the file history database comprising characteristics relating to a previous state of the files prior to a time associated with the current state, the characteristics comprising for a first one of the one or more sets of files at least one of metadata of at least one file of the first set, a relationship of at least one file of the first set to one or more other files, and a rate of change of multiple files of the first set;
applying weights to respective comparison results;
and
generating the detection score based at least in part on the weighted comparison results;
a given one of the comparison results comprising a result of comparing a particular one of the characteristics for the current state of one or more designated ones of the files with the particular characteristic for the previous state of the one or more designated ones of the files;
wherein the security appliance is implemented by at least one processing device comprising a processor coupled to a memory.

9 more elements

A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes said at least one processing device:

to associate a security appliance with at least one storage device;
to configure a ransomware detector in the security appliance;
to generate a detection score in the ransomware detector for one or more sets of files stored in the storage device;
and
to generate an alert if the detection score for the one or more sets of stored files exceeds a specified threshold;
wherein generating the detection score comprises:
comparing characteristics relating to a current state of the files with information stored in a file history database, the information stored in the file history database comprising characteristics relating to a previous state of the files prior to a time associated with the current state, the characteristics comprising for a first one of the one or more sets of files at least one of metadata of at least one file of the first set, a relationship of at least one file of the first set to one or more other files, and a rate of change of multiple files of the first set;
applying weights to respective comparison results;
and
generating the detection score based at least in part on the weighted comparison results;
a given one of the comparison results comprising a result of comparing a particular one of the characteristics for the current state of one or more designated ones of the files with the particular characteristic for the previous state of the one or more designated ones of the files.

8 more elements

Dependencies are inferred from the claim text.