US 10,311,234 B2 · Anti-ransomware

Abstract

According to an aspect of the present disclosure, a digital processing system, in response to identifying multiple files opened with write permission by a process, creates a corresponding backup copy of each of the opened files. The system computes a frequency of opening of the files with write permission by the process, and then determines whether the computed frequency is greater than a threshold. If the frequency is determined to be greater than the threshold, the system provides control to a user to recover any of the files (opened by the process) based on the corresponding backup copy (previously created in response to opening). Thus, the execution of a ransomware in the system may be potentially detected and the associated maladies (such as unavailability of personal data, requirement to make payment for recovering the personal data, etc.) may be avoided.

Claims20

Dependent claims

A computer implemented method comprising:

identifying a plurality of files opened with write permission, but not with read permission, by a process;
creating, in response to said identifying, a corresponding backup copy of each of said plurality of files opened with write permission, but not with read permission, by said process;
computing a frequency of opening with write permission, but not with read permission, of said plurality of files by said process;
determining whether said frequency is greater than a threshold;
and
if said frequency is determined to be greater than said threshold, providing control to a user to recover any of said plurality of files based on said corresponding backup copy.

3 more elements

A non-transitory machine readable medium storing one or more sequences of instructions for enabling a digital processing system to facilitate users to recover from ransomware, a wherein execution of said one or more instructions by one or more processors contained in said digital processing system enables said digital processing system to perform the actions of:

identifying a plurality of files stored on a first storage that are opened with write permission, but not with read permission, by a process;
creating, in response to said identifying, a corresponding backup copy of each of said plurality of files opened with write permission, but not with read permission, by said process;
computing a frequency of opening with write permission, but not with read permission, of said plurality of files by said process;
determining whether said frequency is greater than a threshold;
and
if said frequency is determined to be greater than said threshold, providing control to a user to recover any of said plurality of files based on said corresponding backup copy, wherein recovering a file of said plurality of files entails overwriting the file stored in said first storage with the corresponding backup copy of the file.

3 more elements

A digital processing system comprising:

a processor;
a random access memory (RAM);
a machine readable medium to store one or more instructions, which when retrieved into said RAM and executed by said processor causes said digital processing system to perform the actions of:
identifying a plurality of files opened with write permission, but not with read permission, by a process;
creating, in response to said identifying, a corresponding backup copy of each of said plurality of files opened with write permission, but not with read permission, by said process;
computing a frequency of opening with write permission, but not with read permission, of said plurality of files by said process;
determining whether said frequency is greater than a threshold;
and
if said frequency is determined to be greater than said threshold, providing control to a user to recover any of said plurality of files based on said corresponding backup copy.

6 more elements

Dependencies are inferred from the claim text.

Anti-ransomware

Life of this patent

Anti-ransomware

Life of this patent

Abstract

Claims20