Back to results
US 10,193,918 B1Granted
Behavior-based ransomware detection using decoy files
AssigneeMalwarebytes Inc.
InventorsMark William Patton, Nathan Scott, Ramon Royo Gutierrez, Sherab Giovannini
Life of this patent
Estimating the term…
Abstract
An anti-malware application analyzes behavior of an executing process to identify ransomware. The anti-malware application detects an untrusted process requesting enumeration of a directory of user files and causes the untrusted process to initially operate on a decoy file that mimics the user files. If the behavior of the untrusted process with respect to the decoy file is indicative of ransomware, the process can be terminated without loss of the user files. The decoy file may be deployed in a way that is undetectable to the user.
Claims14
A method for detecting and remediating ransomware, the method comprising:
- monitoring a plurality of processes executing on a client device;
- identifying, from the plurality of processes, an untrusted process that is absent from a whitelist of trusted processes;
- monitoring the untrusted process executing on the client device;
- detecting a request by the untrusted process to enumerate a directory containing one or more user files;
- causing a decoy file to be returned to the untrusted process in response to the request;
- monitoring actions of the untrusted process performed on the decoy file;
- determining sub-scores associated with each of the monitored actions performed on the decoy file;
- generating a cumulative score for the untrusted process based on a combination of the sub-scores associated with the monitored actions;
- determining that the cumulative score for the untrusted process exceeds a predefined threshold score;
- responsive to determining that the cumulative score exceeds the predefined threshold score, determining that behavior of untrusted process exhibited malicious behavior with respect to the decoy file;
- identifying, by a processor, the untrusted process as corresponding to the ransomware based at least in part on determining that the untrusted process exhibited the malicious behavior with respect to the decoy file;
- and
- remediating the untrusted process responsive to identifying the process as corresponding to the ransomware.
10 more elements
A non-transitory computer-readable storage medium storing instructions for detecting and remediating ransomware, the instructions when executed by a processor cause the processor to perform steps including:
- monitoring a plurality of processes executing on a client device;
- identifying, from the plurality of processes, an untrusted process that is absent from a whitelist of trusted processes;
- monitoring the untrusted process executing on the client device;
- detecting, by a processor, a request by the untrusted process to enumerate a directory containing one or more user files;
- causing a decoy file to be returned to the untrusted process in response to the request;
- monitoring actions of the untrusted process performed on the decoy file;
- determining sub-scores associated with each of the monitored actions performed on the decoy file;
- generating a cumulative score for the untrusted process based on a combination of the sub-scores associated with the monitored actions;
- determining that the cumulative score for the untrusted process exceeds a predefined threshold score;
- responsive to determining that the cumulative score exceeds the predefined threshold score, determining that behavior of untrusted process exhibited malicious behavior with respect to the decoy file;
- identifying the untrusted process as corresponding to the ransomware based at least in part on determining that the untrusted process exhibited the malicious behavior with respect to the decoy file;
- and
- remediating the untrusted process responsive to identifying the process as corresponding to the ransomware.
10 more elements
A computing system comprising:
- a processor;
- and
- a non-transitory computer-readable storage medium storing instructions for detecting and remediating ransomware, the instructions when executed by the processor cause the processor to perform steps including:
- monitoring a plurality of processes executing on a client device;
- identifying, from the plurality of processes, an untrusted process that is absent from a whitelist of trusted processes;
- monitoring the untrusted process executing on the client device;
- detecting, by a processor, a request by the untrusted process to enumerate a directory containing one or more user files;
- causing a decoy file to be returned to the untrusted process in response to the request;
- monitoring actions of the untrusted process performed on the decoy file;
- determining sub-scores associated with each of the monitored actions performed on the decoy file;
- generating a cumulative score for the untrusted process based on a combination of the sub-scores associated with the monitored actions;
- determining that the cumulative score for the untrusted process exceeds a predefined threshold score;
- responsive to determining that the cumulative score exceeds the predefined threshold score, determining that behavior of untrusted process exhibited malicious behavior with respect to the decoy file;
- identifying the untrusted process as corresponding to the ransomware based at least in part on determining that the untrusted process exhibited the malicious behavior with respect to the decoy file;
- and
- remediating the untrusted process responsive to identifying the process as corresponding to the ransomware.
13 more elements
Dependencies are inferred from the claim text.