# US 11,308,208 B2 · Classifying ransom notes in received files for ransomware process detection and prevention

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,308,208 B2
- Document ID: US11308208B2
- Status: Granted
- Kind: B2
- Application number: 16/528,280
- Filed: 2019-07-31
- Published: 2020-02-06
- Granted: 2022-04-19
- Earliest claimed: 2018-08-03
- Assignees: Endgame, Inc.
- Applicants: Endgame, Inc.
- Inventors: Mark Mager
- Web page: https://patentgrep.com/patent/US11308208B2

## CPC

- G06F 21/565: {by checking file integrity}
- G06F 21/554: {involving event detection and direct action}
- G06F 2221/034: Test or assess a computer or a system
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

The present invention analyzes the text of a received file to determine if the file likely is a forensic artifact of a ransomware attack on a computer system. If the computer system concludes that the file is likely an artifact of a ransomware attack, the system terminates or ignores all related processes, thereby minimizing the harm caused to the computer system.

## Claims

### Claim 1

A method of determining that a file received by a computing device comprises malicious code, the method comprising:
receiving a file in hardware memory in response to a file change event, the file being restricted to a particular file extension or a particular file type;
identifying the particular file type for the file;
extracting or generating raw text from the file, the file being a text file type;
extracting visual text from the file and converting the visual text to the raw text using optical character recognition processes, the file being an image file type used by ransomware when locking a user interface or changing a desktop wallpaper;
analyzing the raw text to generate a result comprising a vector set;
generating a score based on the result; and
taking protective action if the score exceeds a predetermined threshold, the predetermined threshold indicating the raw text being characteristic of a ransom note contained within a file comprising malicious code, and the protective action comprising automatically suspending a process in real time that caused the file change event.

### Claim 2 (depends on 1)

The method of claim 1, wherein the analyzing step comprises:
tokenizing the raw text to generate tokens;
lemmatizing the tokens to generate lemmatized tokens; and
vectorizing the lemmatized tokens to generate the result using a trained model based on term frequency-inverse document frequency, wherein the result comprises a vector set.

### Claim 3 (depends on 2)

The method of claim 2, wherein the protective action comprises:
suspending a process associated with the file.

### Claim 4 (depends on 3)

The method of claim 3, wherein the protective action further comprises generating an alert for a user.

### Claim 5 (depends on 2)

The method of claim 2, wherein the protective action comprises:
generating an alert for a user.

### Claim 6 (depends on 1)

The method of claim 1, wherein the protective action comprises:
suspending a process associated with the file.

### Claim 7 (depends on 6)

The method of claim 6, wherein the protective action further comprises generating an alert for a user.

### Claim 8 (depends on 1)

The method of claim 1, wherein the protective action comprises:
generating an alert for a user.

### Claim 9

A computer-readable storage medium storing instructions that, when executed by a computer, cause the computer to perform the following steps:
receive a file in hardware memory in response to a file change event, the file being restricted to a particular file extension or a particular file type;
identify the particular file type for the file;
extract or generate raw text from the file, the file being a text file type;
extract visual text from the file and convert the visual text to the raw text using optical character recognition processes, the file being an image file type used by ransomware when locking a user interface or changing a desktop wallpaper;
analyze the raw text to generate a result comprising a vector set;
generate a score based on the result; and
perform protective action if the score exceeds a predetermined threshold, the predetermined threshold indicating the raw text being characteristic of a ransom note contained within a file comprising malicious code, and the protective action comprising automatically suspending a process in real time that caused the file change event.

### Claim 10 (depends on 9)

The computer-readable storage medium of claim 9, wherein the analyze step comprises:
tokenizing the raw text to generate tokens;
lemmatizing the tokens to generate lemmatized tokens; and
vectorizing the lemmatized tokens to generate the result using a trained model based on term frequency-inverse document frequency, wherein the result comprises a vector set.

### Claim 11 (depends on 10)

The computer-readable storage medium of claim 10, wherein the protective action comprises:
suspending a process associated with the file.

### Claim 12 (depends on 11)

The computer-readable storage medium of claim 11, wherein the protective action further comprises generating an alert for a user.

### Claim 13 (depends on 10)

The computer-readable storage medium of claim 10, wherein the protective action comprises:
generating an alert for a user.

### Claim 14 (depends on 9)

The computer-readable storage medium of claim 9, wherein the protective action comprises:
suspending a process associated with the file.

### Claim 15 (depends on 14)

The computer-readable storage medium of claim 14, wherein the protective action further comprises generating an alert for a user.

### Claim 16 (depends on 9)

The computer-readable storage medium of claim 9, wherein the protective action comprises:
generating an alert for a user.

### Claim 17

A computing device comprising a processor and memory, wherein during operation the processor is configured by software instructions stored in the memory to:
receive a file in hardware memory in response to a file change event, the file being restricted to a particular file extension or a particular file type;
identify the particular file type for the file;
extract or generate raw text from the file, the file being a text file type;
extract visual text from the file and convert the visual text to the raw text using optical character recognition processes, the file being an image file type used by ransomware when locking a user interface or changing a desktop wallpaper;
tokenize the raw text to generate tokens;
lemmatize the tokens to generate lemmatized tokens;
vectorize the lemmatized tokens using a trained model based on term frequency-inverse document frequency to generate a vector set;
generate a score based on the vector set; and
perform protective action if the score exceeds a predetermined threshold, the predetermined threshold indicating the raw text being characteristic of a ransom note contained within a file comprising malicious code, and the protective action comprising automatically suspending a process in real time that caused the file change event.

### Claim 18 (depends on 17)

The computing device of claim 17, wherein the protective action comprises:
suspending a process associated with the file.

### Claim 19 (depends on 18)

The computing device of claim 18, wherein the protective action further comprises:
generating an alert for a user.

### Claim 20 (depends on 17)

The computing device of claim 17, wherein the protective action comprises:
generating an alert for a user.