Systems and methods of detecting and responding to a data attack on a file system

A method of detecting a ransomware attack impacting a cloud-based file storage service, the method comprising:

• collecting content properties from payloads of files stored on the cloud-based file storage service, as the files are manipulated,
• wherein the cloud-based file storage service supports manipulation by creating, editing and sharing the files, and
• wherein the collected content properties include a computed entropy or layered entropy, a locality-sensitive hashing (LSH) and an indication of an occurrence of a stub;
• storing the collected content properties as historical content properties separate from and not under control of the cloud-based file storage service, as the files are manipulated;
• detecting multiple artifacts of the ransomware attack resulting from ransomware manipulation of the files, the detecting including:
• comparing the computed entropy or layered entropy, the LSH and the indication of the occurrence of the stub included in the historical content properties to respective computed entropy or layered entropy, LSH and an indication of an occurrence of the stub included in current content properties of the files to identify changes in the files;
• detecting a pattern of the identified changes from the historical content properties to the current content properties;
• detecting that the identified changes in the detected pattern exceed a predetermined change velocity to determine that the ransomware attack is in progress;
• and
• comparing the current content properties to a known ransomware content properties pattern and determining that the ransomware attack is in progress in response to a match between the current content properties and the known ransomware content properties pattern;
• and
• identifying a user and/or machine that manipulated the files exhibiting the multiple artifacts and responding to the detection of the ransomware attack by restricting further manipulation of other files on the cloud-based file storage service by the identified user and/or machine,
• wherein at least a portion of the content properties is actively collected and stored using an active agent of a proxy device positioned between users and the cloud-based file storage service during the manipulation of the files, and
• wherein at least a portion of the content properties is introspectively collected and stored using an inspective agent of the proxy device through an application programming interface to the cloud-based file storage service in response to the manipulation of files that are transferred to the cloud-based file storage service using a network that is outside of a network through which the content properties are actively collected by the active agent.

A method of detecting a ransomware attack impacting a cloud-based file storage service, the method comprising:

• collecting current content property parameters on files stored on the cloud-based file storage service as the files are manipulated,
• wherein the cloud-based file storage service supports manipulation by creating, editing and sharing the files, and
• wherein the collected current content property parameters include a magic number, an edit distance, and a computed entropy;
• detecting multiple artifacts of the ransomware attack resulting from the ransomware manipulation of the files, the detecting including:
• repeatedly calculating a moving average of velocities of change for the current content property parameters of the files by:
• for each respective parameter of the current content property parameters, maintaining a buffer of time-based parameter change statistics;
• in a moving time-based window applied to the buffer, calculating the moving average of velocity of change for the respective parameter;
• setting an upper threshold and a lower threshold according to n-standard deviations of the calculated moving average of velocities of change, n being an integer;
• comparing the calculated moving average of velocities of change to the upper threshold and the lower threshold;
• and
• determining that the ransomware attack is in progress when the calculated moving average of velocities of change is above the upper threshold or below the lower threshold;
• and
• comparing the current content property parameters to a known ransomware content property parameters pattern and determining that the ransomware attack is in progress in response to a match between the current content property parameters and the known ransomware content property parameters pattern;
• and
• identifying a user and/or machine that manipulated the files exhibiting the multiple artifacts and responding to the detection of the ransomware attack by restricting further manipulation of other files on the cloud-based file storage service by the identified user and/or machine,
• wherein at least a portion of the current content property parameters is actively collected and stored using an active agent of a proxy device positioned between users and the cloud-based file storage service during the manipulation of the files, and
• wherein at least a portion of the current content property parameters is introspectively collected and stored using an inspective agent of the proxy device through an application programming interface to the cloud-based file storage service in response to the manipulation of files that are transferred to the cloud-based file storage service using a network that is outside of a network through which the metadata is actively collected by the active agent.