# US 10,122,752 B1 · Detecting and preventing crypto-ransomware attacks against data

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,122,752 B1
- Document ID: US10122752B1
- Status: Granted
- Kind: B1
- Application number: 15/179,508
- Filed: 2016-06-10
- Granted: 2018-11-06
- Earliest claimed: 2016-06-10
- Assignees: VMware, Inc.
- Applicants: VMware, Inc.
- Inventors: Sisimon Soman; Matthew Conover
- Web page: https://patentgrep.com/patent/US10122752B1

## CPC

- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- G06F 16/122: {using management policies (point-in-time backing up or restoration of persistent data G06F11/1446; file migration policies for HSM systems G06F16/185)}
- G06F 16/152: {using file content signatures, e.g. hash values}
- G06F 16/164: {File meta data generation}
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Embodiments perform detection and prevention of unauthorized access to files in a target folder. A filter driver, interfacing with a target folder, intercepts a first request from a process to access a file in the target folder. The filter driver returns a virtual file, along with the existing files, to the process. Upon receiving a second request from the process to write to the virtual file, the filter driver designates the process as a hostile process and prevents further access attempts.

## Claims

### Claim 1

A method for preventing unauthorized file access, the method comprising:
heuristically analyzing an attack to identify an access pattern, the access pattern comprising a sort method and a first attacked position;
intercepting a first request from a process to access a target folder;
in response to intercepting the first request, creating a virtual file;
compiling a set of files from the target folder based on the intercepted first request;
sorting the compiled set of files in accordance with the sort method;
placing the virtual file in the first attacked position in the set;
returning the sorted, compiled set of files to the process; and
upon receiving a second request from the process to alter the virtual file, designating the process as a hostile process.

### Claim 2 (depends on 1)

The method of claim 1, wherein designating the process as a hostile process comprises locking one or more files for read-only access by the process.

### Claim 3 (depends on 1)

The method of claim 1, further comprising accessing a policy comprising instructions to be executed upon designating the process as the hostile process.

### Claim 4 (depends on 3)

The method of claim 3, wherein the policy instructs a filter driver to perform actions selected from a group consisting of suspending input/output (I/O) operations to the target folder, suspending I/O operations to a plurality of target folders accessible by the filter driver, suspending I/O operations to the set of files, notifying administrator of the detection of the hostile process, powering-down a host computing device associated with the filter driver, terminating a network connection associated with the system, and suspending a virtual machine associated with the filter driver.

### Claim 5 (depends on 1)

The method of claim 1, wherein placing the virtual file in the first attacked position comprises placing the virtual file first in the set.

### Claim 6 (depends on 5)

The method of claim 5, wherein the created virtual file is hidden from a user.

### Claim 7 (depends on 1)

The method of claim 1 further comprises presenting a name and a size for the virtual file, and wherein the size is generated by applying an algorithm to the name.

### Claim 8 (depends on 5)

The method of claim 5, wherein the method further comprises storing the name for the duration of a session with the process.

### Claim 9

A system, comprising:
a processor; and
a non-transitory computer readable medium having stored thereon program code for transferring data to another computer system, the program code causing the processor to:
heuristically analyze an attack to identify an access pattern, the access pattern comprising a sort method and a first attacked position;
intercept a first request from a process to access a target folder containing at least one file;
in response to intercepting the first request, create a virtual file;
compile a set of files from the target folder based on the intercepted first request;
sort the compiled set of files in accordance with the sort method
place the virtual file in the first attacked position in the set;
return the sorted, compiled set of files to the process; and
upon receiving a second request from the process to access the virtual file, designate the process as a hostile process.

### Claim 10 (depends on 9)

The system of claim 9, wherein the memory area further stores an authorized process list comprising at least one process identified as not hostile.

### Claim 11 (depends on 10)

The system of claim 10, wherein the program code further causes the processor to:
compare the process to the authorized process list; and
if the process is located on the authorized process list, allow the process to access the target folder without designating the process as the hostile process.

### Claim 12 (depends on 9)

The system of claim 9, further comprising a plurality of host computing devices associated with the system, and wherein the program code further causes the processor to issue an alert to the plurality of host computing devices associated with the system.

### Claim 13 (depends on 12)

The system of claim 12, wherein the program code further causes the processor to:
receive an alert from at least one of the plurality of host computing devices, the alert identifying the hostile process; and
based on the received alert, lock the target folder from access by the hostile process.

### Claim 14 (depends on 9)

The system of claim 9, wherein placing the created virtual file in the first attacked position comprises placing the created virtual file first in the set.

### Claim 15 (depends on 9)

The system of claim 9, wherein the created virtual file is hidden from a user.

### Claim 16 (depends on 9)

The system of claim 9, wherein the program code further causes the processor to access a policy comprising instructions to be executed upon designating the process as the hostile process.

### Claim 17

A non-transitory computer readable storage medium having stored thereon program code executable by a first computer system at a first site, the program code embodying a method comprising:
heuristically analyzing an attack to identify an access pattern, the access pattern comprising a sort method and a first attacked position;
intercepting a first request from a process to access a target folder;
in response to intercepting the first request, creating a virtual file;
compiling a set of files from the target folder based on the intercepted first request;
sorting the compiled set of files in accordance with the sort method
placing the virtual file in the first attacked position in the set;
returning the sorted, compiled set of files to the process; and
upon receiving a second request from the process to access the virtual file, designating the process as a hostile process.

### Claim 18 (depends on 17)

The non-transitory computer-readable storage media of claim 17, wherein creating the virtual file comprises creating the virtual file once per target folder per a targeted file type.

### Claim 19 (depends on 17)

The non-transitory computer-readable storage media of claim 17, wherein the created virtual file is hidden from a user.

### Claim 20 (depends on 17)

The non-transitory computer-readable storage media of claim 17, wherein issuing the alert comprises notifying a computing device across a network.