Detecting and preventing crypto-ransomware attacks against data
AssigneeVMware, Inc.
InventorsSisimon Soman, Matthew Conover
Life of this patent
Estimating the term…
Abstract
Embodiments perform detection and prevention of unauthorized access to files in a target folder. A filter driver, interfacing with a target folder, intercepts a first request from a process to access a file in the target folder. The filter driver returns a virtual file, along with the existing files, to the process. Upon receiving a second request from the process to write to the virtual file, the filter driver designates the process as a hostile process and prevents further access attempts.
Claims20
A method for preventing unauthorized file access, the method comprising:
- heuristically analyzing an attack to identify an access pattern, the access pattern comprising a sort method and a first attacked position;
- intercepting a first request from a process to access a target folder;
- in response to intercepting the first request, creating a virtual file;
- compiling a set of files from the target folder based on the intercepted first request;
- sorting the compiled set of files in accordance with the sort method;
- placing the virtual file in the first attacked position in the set;
- returning the sorted, compiled set of files to the process;
- and
- upon receiving a second request from the process to alter the virtual file, designating the process as a hostile process.
A system, comprising:
- a processor;
- and
- a non-transitory computer readable medium having stored thereon program code for transferring data to another computer system, the program code causing the processor to:
- heuristically analyze an attack to identify an access pattern, the access pattern comprising a sort method and a first attacked position;
- intercept a first request from a process to access a target folder containing at least one file;
- in response to intercepting the first request, create a virtual file;
- compile a set of files from the target folder based on the intercepted first request;
- sort the compiled set of files in accordance with the sort method
- place the virtual file in the first attacked position in the set;
- return the sorted, compiled set of files to the process;
- and
- upon receiving a second request from the process to access the virtual file, designate the process as a hostile process.
A non-transitory computer readable storage medium having stored thereon program code executable by a first computer system at a first site, the program code embodying a method comprising:
- heuristically analyzing an attack to identify an access pattern, the access pattern comprising a sort method and a first attacked position;
- intercepting a first request from a process to access a target folder;
- in response to intercepting the first request, creating a virtual file;
- compiling a set of files from the target folder based on the intercepted first request;
- sorting the compiled set of files in accordance with the sort method
- placing the virtual file in the first attacked position in the set;
- returning the sorted, compiled set of files to the process;
- and
- upon receiving a second request from the process to access the virtual file, designating the process as a hostile process.
Dependencies are inferred from the claim text.