Detecting and stopping ransomware

A computer program product comprising a nontransitive storage medium, the computer program product including code that, when executed by processing circuitry of a computer having a non-volatile memory, causes the processing circuitry to perform a method, the method comprising:

• receiving data including a set of instructions configured to cause the controlling circuitry to perform operating system commands on a set of files stored in the non-volatile memory;
• performing a monitoring operation on the data, including counting a number of files of a specified file type being copied within a specified period of time, to produce a measurement of a rate of performance of the sequence of operating system commands on a subset of the set of files, the copying of a file from the number of files including an opening of the file and a reading of the contents of the file into a volatile memory, and further including (i) counting a number of files for which the sequence of commands read-encrypt-write-delete is performed within a specified time period, a file from the number of files having been read subsequently having been deleted and (ii) counting a number of files having a read-only permission state that have been copied into new files not having the read-only permission state within a specified period of time;
• in response to the measurement of the rate of performance of the operating system commands on the subset of the set of files being greater than a specified threshold, generating an alert indicating that an alert indicating that the operating system commands were issued by a malicious actor;
• and
• in response to the measurement of the rate of performance of the operating system commands on the subset of the set of files being less than the specified threshold, not generating the alert.

An electronic apparatus having a non-volatile memory, the electronic apparatus comprising:

• memory;
• and
• controlling circuitry coupled to the memory, the controlling circuitry being configured to:
• receive data including a set of instructions configured to cause the controlling circuitry to perform operating system commands on a set of files stored in the non-volatile memory;
• perform a monitoring operation on the data, including counting a number of files of a specified file type being copied within a specified period of time, to produce a measurement of a rate of performance of the sequence of operating system commands on a subset of the set of files, the copying of a file from the number of files including an opening of the file and a reading of the contents of the file into a volatile memory, and further including (i) counting a number of files for which the sequence of commands read-encrypt-write-delete is performed within a specified time period, a file from the number of files having been read subsequently having been deleted and (ii) counting a number of files having a read-only permission state that have been copied into new files not having the read-only permission state within a specified period of time;
• in response to the measurement of the rate of performance of the operating system commands on the subset of the set of files being greater than a specified threshold, generate an alert indicating that an alert indicating that the operating system commands were issued by a malicious actor;
• and
• in response to the measurement of the rate of performance of the operating system commands on the subset of the set of files being less than the specified threshold, not generate the alert.