# US 10,769,278 B2 · Service identification of ransomware impact at account level > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,769,278 B2 - Document ID: US10769278B2 - Status: Granted - Kind: B2 - Application number: 15/941,243 - Filed: 2018-03-30 - Published: 2019-10-03 - Granted: 2020-09-08 - Earliest claimed: 2018-03-30 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Filip Chelarescu; Parthipan Thayanithy; Meir E. Abergel; John D Rodrigues - Web page: https://patentgrep.com/patent/US10769278B2 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 16/16: File or folder operations, e.g. details of user interfaces specifically adapted to file systems - G06F 16/2358: {Change logging, detection, and notification (replication G06F16/27)} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/565: {by checking file integrity} - G06F 21/568: {eliminating virus, restoring damaged files} - G06N 20/00: Machine learning - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A cloud storage server determines features of files in a storage account of the cloud storage server. The storage account is registered with a client device. The cloud storage server detects ransomware activity based on the features of the files. A notification is generated to the client device. The notification indicates the detected ransomware activity in the storage account, and one or more remediation options for the detected ransomware activity in the storage account. The cloud storage server receives, from the client device, a remediation option selected from the one or more remediation options and recovers one or more files in the storage account based on the selected remediation option. ## Claims ### Claim 1 A computer-implemented method comprising: determining features of files in a storage account of a cloud storage server, the storage account registered with a client device; detecting ransomware activity based on the features of the files; generating a notification to the client device in response to detecting the ransomware activity, the notification indicating the detected ransomware activity in the storage account, and one or more remediation options for the detected ransomware activity in the storage account; receiving, from the client device, a remediation option selected from the one or more remediation options; recovering one or more files in the storage account based on the selected remediation option; receiving, at the cloud storage server, a request from the client device to perform changes to one or more files in the storage account of the cloud storage server; and prior to detecting the ransomware activity, completing the requested changes to the one or more files in the storage account of the cloud storage server. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the ransomware activity is detected based on the features of the changed files after the cloud storage server performs the changes to the one or more files. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein determining the features of the files comprises: computing a file churn based on changes to one or more files in the storage account within a predefined period of time; computing a number of files being encrypted within the predefined period of time; identifying a name extension and a naming pattern for the one or more files in the storage account; and identifying a content type for the one or more files in the storage account. ### Claim 4 (depends on 3) The computer-implemented method of claim 3, wherein detecting the ransomware activity further comprises: determining that the file churn exceeds a preset churn threshold; determining that the number of files being encrypted within the predefined period of time exceeds a preset encrypted file number threshold; determining that the name extension or the naming pattern for the one or more files in the storage account corresponds to a name extension or a naming pattern associated with known ransomware; and determining that the content type for the one or more files in the storage account does not match corresponding content for the one or more files. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, further comprising: generating a request to the client device in response to detecting the ransomware activity in the storage account, the request including a request to confirm a presence of the ransomware activity in the storage account; receiving, from the client device, a ransomware confirmation in response to the request, the ransomware confirmation indicating a confirmation of the presence or an absence of the ransomware activity in the storage account; and training a machine learning system of the cloud storage server with the ransomware confirmation, the machine learning system configured to identify ransomware activity in the storage account of the cloud storage server. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein detecting the ransomware activity is based on a client-based malware notification from a client-based malware application operating at the client device. ### Claim 7 (depends on 3) The computer-implemented method of claim 3, wherein detecting the ransomware activity is based on a second ransomware confirmation from a second client device, the second ransomware confirmation indicating a confirmation of a presence of ransomware activity in files stored in a second storage account associated with the second client device in the cloud storage server. ### Claim 8 (depends on 7) The computer-implemented method of claim 7, wherein the files in the second storage account share similar features with the files in the storage account. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, wherein the file churn of the storage account is at least equal to a file churn in the second storage account, wherein the number of files being encrypted in the storage account within the predefined period of time is at least equal to a number of files being encrypted in the second storage account within the predefined period of time, wherein the name extension and the naming pattern for the one or more files in the storage account are the same as a name extension and a naming pattern for one or more files in the second storage account. ### Claim 10 (depends on 1) The computer-implemented method of claim 1, wherein the one or more remediation options comprise recovering the one or more files to a version associated with one of a plurality of recovery times prior to a detection time of the ransomware activity, and recovering the one or more files from a recycle bin of the storage account. ### Claim 11 A system comprising: one or more hardware processors; and a memory storing instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations comprising: determining features of files in a storage account of a cloud storage server, the storage account registered with a client device; detecting ransomware activity based on the features of the files; generating a notification to the client device in response to detecting the ransomware activity, the notification indicating the detected ransomware activity in the storage account, and one or more remediation options for the detected ransomware activity in the storage account; receiving, from the client device, a remediation option selected from the one or more remediation options; recovering one or more files in the storage account based on the selected remediation option; receiving, at the cloud storage server, a request from the client device to perform changes to one or more files in the storage account of the cloud storage server; and prior to detecting the ransomware activity, completing the requested changes to the one or more files in the storage account of the cloud storage server. ### Claim 12 (depends on 11) The system of claim 11, wherein the ransomware activity is detected based on the features of the changed files after the cloud storage server performs the changes to the one or more files. ### Claim 13 (depends on 11) The system of claim 11, wherein determining the features of the files comprises: computing a file churn based on changes to one or more files in the storage account within a predefined period of time; computing a number of files being encrypted within the predefined period of time; identifying a name extension and a naming pattern for the one or more files in the storage account; and identifying a content type for the one or more files in the storage account. ### Claim 14 (depends on 13) The system of claim 13, wherein detecting the ransomware activity further comprises: determining that the file churn exceeds a preset churn threshold; determining that the number of files being encrypted within the predefined period of time exceeds a preset encrypted file number threshold; determining that the name extension or the naming pattern for the one or more files in the storage account corresponds to a name extension or a naming pattern associated with known ransomware; and determining that the content type for the one or more files in the storage account does not match corresponding content for the one or more files. ### Claim 15 (depends on 11) The system of claim 11, wherein the operations further comprise: generating a request to the client device in response to detecting the ransomware activity in the storage account, the request including a request to confirm a presence of the ransomware activity in the storage account; receiving, from the client device, a ransomware confirmation in response to the request, the ransomware confirmation indicating a confirmation of the presence or an absence of the ransomware activity in the storage account; and training a machine learning system of the cloud storage server with the ransomware confirmation, the machine learning system configured to identify ransomware activity in the storage account of the cloud storage server. ### Claim 16 (depends on 11) The system of claim 11, wherein detecting the ransomware activity is based on a client-based malware notification from a client-based malware application operating at the client device. ### Claim 17 (depends on 13) The system of claim 13, wherein detecting the ransomware activity is based on a second ransomware confirmation from a second client device, the second ransomware confirmation indicating a confirmation of a presence of ransomware activity in files stored in a second storage account associated with the second client device in the cloud storage server. ### Claim 18 (depends on 17) The system of claim 17, wherein the file churn of the storage account is at least equal to a file churn in the second storage account, wherein the number of files being encrypted in the storage account within the predefined period of time is at least equal to a number of files being encrypted in the second storage account within the predefined period of time, wherein the name extension and the naming pattern for the one or more files in the storage account are the same as a name extension and a naming pattern for one or more files in the second storage account. ### Claim 19 (depends on 11) The system of claim 11, wherein the one or more remediation options comprise recovering the one or more files to a version associated with one of a plurality of recovery times prior to a detection time of the ransomware activity, and recovering the one or more files from a recycle bin of the storage account. ### Claim 20 A non-transitory machine-storage medium storing instructions that, when executed by one or more processors of a machine, cause the one or more processors to perform operations comprising: determining features of files in a storage account of a cloud storage server, the storage account registered with a client device; detecting ransomware activity based on the features of the files; generating a notification to the client device in response to detecting the ransomware activity, the notification indicating the detected ransomware activity in the storage account, and one or more remediation options for the detected ransomware activity in the storage account; receiving, from the client device, a remediation option selected from the one or more remediation options; recovering one or more files in the storage account based on the selected remediation option; receiving, at the cloud storage server, a request from the client device to perform changes to one or more files in the storage account of the cloud storage server; and prior to detecting the ransomware activity, completing the requested changes to the one or more files in the storage account of the cloud storage server.