Back to results
US 10,229,269 B1Granted
Detecting ransomware based on file comparisons
AssigneeMalwarebytes Inc.
InventorsMark William Patton, Zohiartze Herce San Martín, Jorge Alejandro Duran Royo, Sherab Giovannini
Life of this patent
Estimating the term…
Abstract
An anti-malware application detects and remediates ransomware. The anti-malware application monitors processes executing on a computing device and detects that a process is opening a file for editing. A portion of the original file is saved prior to being edited by the process. Once the edited file is saved, the anti-malware application compares a portion of the edited file to the portion of the original file to determine if the edited file is encrypted. The anti-malware application may determine the process is associated with ransomware based on whether the edited file is encrypted.
Claims20
A method for detecting ransomware comprising:
- monitoring a process executing on a computing device;
- detecting, by a processor, an opening of an original file by the process for editing;
- responsive to detecting the opening of the original file by the process for editing, saving a portion of the original file prior to the original file being edited by the process;
- detecting, by the processor, saving of an edited file, corresponding to the original file edited by the process;
- responsive to detecting the saving of the edited file, dividing the portion of the edited file into chunks;
- dividing the portion of the original file into chunks corresponding to the chunks of the edited file;
- performing comparisons between chunk pairs, each comprising a chunk of the original file and a corresponding chunk of the edited file;
- determining respective difference measures for each of the chunk pairs based on the comparisons;
- determining chunk pairs that have difference measures meeting a modification threshold;
- calculating one or more entropy parameters representing an average of entropy differences between respective chunks in each of the chunk pairs that have the difference measures meeting the modification threshold;
- determining, by the processor, whether the edited file is encrypted based on the one or more entropy parameters;
- determining if the process corresponds to the ransomware based on detecting that the edited file is encrypted;
- and
- responsive to determining that the process corresponds to the ransomware, remediating the process.
11 more elements
A non-transitory computer-readable storage medium storing instructions for detecting ransomware, the instructions when executed by a processor cause the processor to perform steps including:
- monitoring a process executing on a computing device;
- detecting, by a processor, an opening of an original file by the process for editing;
- responsive to detecting the opening of the original file by the process for editing, saving a portion of the original file prior to the original file being edited by the process;
- detecting, by the processor, saving of an edited file, corresponding to the original file edited by the process;
- responsive to detecting the saving of the edited file, dividing the portion of the edited file into chunks;
- dividing the portion of the original file into chunks corresponding to the chunks of the edited file;
- performing comparisons between chunk pairs, each comprising a chunk of the original file and a corresponding chunk of the edited file;
- determining respective difference measures for each of the chunk pairs based on the comparisons;
- determining chunk pairs that have difference measures meeting a modification threshold;
- calculating one or more entropy parameters representing an average of entropy differences between respective chunks in each of the chunk pairs that have the difference measures meeting the modification threshold;
- determining, by the processor, whether the edited file is encrypted based on the one or more entropy parameters;
- determining if the process corresponds to the ransomware based on detecting that the edited file is encrypted;
- and
- responsive to determining that the process corresponds to the ransomware, remediating the process.
11 more elements
A computing system comprising:
- a processor;
- and
- a non-transitory computer-readable storage medium storing instructions for detecting ransomware, the instructions when executed by the processor cause the processor to perform steps including:
- monitoring a process executing on a computing device;
- detecting, by a processor, an opening of an original file by the process for editing;
- responsive to detecting the opening of the original file by the process for editing, saving a portion of the original file prior to the original file being edited by the process;
- detecting, by the processor, saving of an edited file, corresponding to the original file edited by the process;
- responsive to detecting the saving of the edited file, dividing the portion of the edited file into chunks;
- dividing the portion of the original file into chunks corresponding to the chunks of the edited file;
- performing comparisons between chunk pairs, each comprising a chunk of the original file and a corresponding chunk of the edited file;
- determining respective difference measures for each of the chunk pairs based on the comparisons;
- determining chunk pairs that have difference measures meeting a modification threshold;
- calculating one or more entropy parameters representing an average of entropy differences between respective chunks in each of the chunk pairs that have the difference measures meeting the modification threshold;
- determining, by the processor, whether the edited file is encrypted based on the one or more entropy parameters;
- determining if the process corresponds to the ransomware based on detecting that the edited file is encrypted;
- and
- responsive to determining that the process corresponds to the ransomware, remediating the process.
14 more elements
Dependencies are inferred from the claim text.