Classifying ransom notes in received files for ransomware process detection and prevention
AssigneeEndgame, Inc.
InventorMark Mager
Life of this patent
Estimating the term…
Abstract
The present invention analyzes the text of a received file to determine if the file likely is a forensic artifact of a ransomware attack on a computer system. If the computer system concludes that the file is likely an artifact of a ransomware attack, the system terminates or ignores all related processes, thereby minimizing the harm caused to the computer system.
Claims20
A method of determining that a file received by a computing device comprises malicious code, the method comprising:
- receiving a file in hardware memory in response to a file change event, the file being restricted to a particular file extension or a particular file type;
- identifying the particular file type for the file;
- extracting or generating raw text from the file, the file being a text file type;
- extracting visual text from the file and converting the visual text to the raw text using optical character recognition processes, the file being an image file type used by ransomware when locking a user interface or changing a desktop wallpaper;
- analyzing the raw text to generate a result comprising a vector set;
- generating a score based on the result;
- and
- taking protective action if the score exceeds a predetermined threshold, the predetermined threshold indicating the raw text being characteristic of a ransom note contained within a file comprising malicious code, and the protective action comprising automatically suspending a process in real time that caused the file change event.
A computer-readable storage medium storing instructions that, when executed by a computer, cause the computer to perform the following steps:
- receive a file in hardware memory in response to a file change event, the file being restricted to a particular file extension or a particular file type;
- identify the particular file type for the file;
- extract or generate raw text from the file, the file being a text file type;
- extract visual text from the file and convert the visual text to the raw text using optical character recognition processes, the file being an image file type used by ransomware when locking a user interface or changing a desktop wallpaper;
- analyze the raw text to generate a result comprising a vector set;
- generate a score based on the result;
- and
- perform protective action if the score exceeds a predetermined threshold, the predetermined threshold indicating the raw text being characteristic of a ransom note contained within a file comprising malicious code, and the protective action comprising automatically suspending a process in real time that caused the file change event.
A computing device comprising a processor and memory, wherein during operation the processor is configured by software instructions stored in the memory to:
- receive a file in hardware memory in response to a file change event, the file being restricted to a particular file extension or a particular file type;
- identify the particular file type for the file;
- extract or generate raw text from the file, the file being a text file type;
- extract visual text from the file and convert the visual text to the raw text using optical character recognition processes, the file being an image file type used by ransomware when locking a user interface or changing a desktop wallpaper;
- tokenize the raw text to generate tokens;
- lemmatize the tokens to generate lemmatized tokens;
- vectorize the lemmatized tokens using a trained model based on term frequency-inverse document frequency to generate a vector set;
- generate a score based on the vector set;
- and
- perform protective action if the score exceeds a predetermined threshold, the predetermined threshold indicating the raw text being characteristic of a ransom note contained within a file comprising malicious code, and the protective action comprising automatically suspending a process in real time that caused the file change event.
Dependencies are inferred from the claim text.