# US 10,375,086 B2 · System and method for detection of malicious data encryption programs > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,086 B2 - Document ID: US10375086B2 - Status: Granted - Kind: B2 - Application number: 14/951,970 - Filed: 2015-11-25 - Published: 2017-03-30 - Granted: 2019-08-06 - Earliest claimed: 2015-09-30 - Assignees: AO Kaspersky Lab - Applicants: Kaspersky Lab AO - Inventors: Vladislav I. Ovcharik; Oleg G. Bykov - Web page: https://patentgrep.com/patent/US10375086B2 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - G06F 21/563: {by source code analysis} - H04L 9/002: {Countermeasures against attacks on cryptographic mechanisms (network architectures or network communication protocols for protection against malicious traffic H04L63/1441)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 2209/34: Encoding or coding, e.g. Huffman coding or error correction - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for detection of malicious encryption programs, the method comprising: intercepting, at a server, a file operation request from a client on a file stored on the server; collecting information about at least the requested file and the requested operation; determining, by a hardware processor of the server, based on the collected information, whether the file operation request came from a known malicious encryption program; when the file operation request came from an unknown program, then calculating, by the hardware processor, entropies of at least a portion of the file before and after the execution of the requested operation on the file; and calculating, by the hardware processor, a difference between the calculated entropies; when the difference is below a threshold, allowing the requested operation on the file; and when the difference is above the threshold, denying the requested operation on the file. ## Claims ### Claim 1 A method for detection of malicious encryption programs, the method comprising: intercepting a file operation request from a client device on a file stored on a server; responsive to intercepting the file operation request, creating and saving a backup copy of the file at the server; collecting information about at least the client device, the requested file and the file operation request, wherein the collected information includes data buffers with original contents of the file and data that the file operation request is attempting to write in place of the file; determining based on the collected information, whether a known malicious encryption program has been launched on the client device to attempt an execution of the file operation request on the server; when the file operation request came from an unknown encryption program, calculating, by a hardware processor, a difference between a first entropy of a header of the file before the execution of the file operation request and a second entropy of a header of the data that the file operation request is attempting to write in place of the file; when the difference is below a threshold, allowing the file operation request of the unknown encryption program on the file to be performed on the server and deleting the backup copy of the file, otherwise blocking a connection between the client device and the server and restoring the backup copy of the file at the server; and sending information about the unknown encryption program to a component on the client device, the information comprising a name of a process executing the program, wherein the component is enabled to search and stop the process on the client device initiating the file operation request based on a reception of the information. ### Claim 2 (depends on 1) The method of claim 1, wherein intercepting a request to access a file stored on the server includes, intercepting the request by a file system driver filter. ### Claim 3 (depends on 1) The method of claim 1, wherein intercepting a request to access a file stored on the server includes, intercepting a system function call and one or more parameters of the call. ### Claim 4 (depends on 1) The method of claim 1, wherein collecting information about the requested file and the file operation request further includes, collecting one or more of: type of the file operation request, and an application programming interface (API) function called. ### Claim 5 (depends on 1) The method of claim 1, wherein, when the file operation request came from a known malicious encryption program, denying the file operation request on the file. ### Claim 6 (depends on 1) The method of claim 1, wherein calculating entropies of at least a portion of the file includes, calculating entropies of at least portions of file headers before and after the execution of the requested operation on the file. ### Claim 7 A system for detection of malicious encryption programs, the system comprising: a server having a hardware processor configured to: intercept a file operation request from a client device on a file stored on the server; responsive to intercepting the file operation request, create and save a backup copy of the file at the server; collect information about at least the client device, the requested file and the file operation request, wherein the collected information includes data buffers with original contents of the file and data that the file operation request is attempting to write in place of the file; determine based on the collected information, whether a known malicious encryption program has been launched on the client device to attempt an execution of the file operation request on the server; when the file operation request came from an unknown encryption program, calculate a difference between a first entropy of a header of the file before the execution of the file operation request and a second entropy of a header of the data that the file operation request is attempting to write in place of the file; when the difference is below a threshold, allow the file operation request of the encryption program on the file to be performed on the server and deleting the backup copy of the file, otherwise: block a connection between the client device and the server and restore the backup copy of the file at the server; and send information about the unknown encryption program to a component on the client device, the information comprising a name of a process executing the program, wherein the component is enabled to search and stop the process on the client device initiating the file operation request based on a reception of the information. ### Claim 8 (depends on 7) The system of claim 7, wherein, to intercept the request to access a file stored on the server, the processor is further configured to intercept the request by a file system driver filter. ### Claim 9 (depends on 7) The system of claim 7, wherein, to intercept the request to access a file stored on the server, the processor is further configured to intercept a system function call and one or more parameters of the call. ### Claim 10 (depends on 7) The system of claim 7, wherein, to collect the information about the requested file and the file operation request, the processor is further configured to collect one or more of: type of the file operation request, and an application programming interface (API) function called. ### Claim 11 (depends on 7) The system of claim 7, wherein the processor is further configured to deny the file operation request on the file when the file operation request came from a known malicious encryption program. ### Claim 12 (depends on 7) The system of claim 7, wherein, to calculate the entropies of at least a portion of the file, the processor is further configured to calculate entropies of at least portions of file headers before and after the execution of the requested operation on the file. ### Claim 13 A non-transitory computer readable medium storing computer executable instructions for detection of malicious encryption programs, including instructions for: intercepting a file operation request from a client device on a file stored on a server; responsive to intercepting the file operation request, creating and saving a backup copy of the file at the server; collecting information about at least the client device, the requested file and the requested operation, wherein the collected information includes data buffers with original contents of the file and data that the file operation request is attempting to write in place of the file; determining, based on the collected information, whether a known malicious encryption program has been launched on the client device to attempt an execution of the file requested operation on the server; when the file operation request came from an unknown encryption program, calculating a difference between a first entropy of a header of the file before the execution of the requested operation and a second entropy of a header of the data that the file operation request is attempting to write in place of the file; when the difference is below a threshold, allowing the requested operation of the encryption program on the file to be performed on the server and deleting the backup copy of the file, otherwise: blocking a connection between the client device and the server and restoring the backup copy of the file at the server; and sending information about the unknown encryption program to a component on the client device, the information comprising a name of a process executing the program, and wherein the component is enabled to search and stop the process on the client device initiating the file operation request based on a reception of the information. ### Claim 14 (depends on 13) The non-transitory computer readable medium of claim 13, wherein intercepting a request to access a file stored on the server includes, intercepting the request by a file system driver filter. ### Claim 15 (depends on 13) The non-transitory computer readable medium of claim 13, wherein intercepting a request to access a file stored on the server includes, intercepting a system function call and one or more parameters of the call. ### Claim 16 (depends on 13) The non-transitory computer readable medium of claim 13, wherein collecting information about the requested file and the file operation request includes, collecting one or more of: type of the requested file operation request, and an application programming interface (API) function called. ### Claim 17 (depends on 13) The non-transitory computer readable medium of claim 13, wherein, when the file operation request came from a known malicious encryption program, denying the file operation request on the file. ### Claim 18 (depends on 13) The non-transitory computer readable medium of claim 13, wherein calculating entropies of at least a portion of the file includes, calculating entropies of at least portions of file headers before and after the execution of the requested operation on the file.