Preventing ransomware from encrypting files on a target machine
AssigneePalo Alto Networks, Inc.
InventorsEldar Aharoni, Vadim Goldstein, Mashav Sapir, Jenny Kitaichik
Life of this patent
Estimating the term…
Abstract
Techniques for preventing ransomware from encrypting files on a target machine are disclosed. In some embodiments, a system/process/computer program product for preventing ransomware from encrypting files on a target machine includes monitoring file system activities on a computing device; detecting an unauthorized activity associated with a honeypot file or honeypot folder; and performing an action based on a policy in response to the unauthorized activity associated with the honeypot file or honeypot folder.
Claims21
A system, comprising:
- a processor configured to:
- detect an unauthorized activity associated with a honeypot file or honeypot folder, wherein the honeypot file is a virtual file generated as a spoofed file system response using a filter driver or the honeypot folder is a virtual folder generated as the spoofed file system response using the filter driver, wherein the virtual file is dynamically generated using the filter driver with at least one of the following:
- a spoofed header, a spoofed time stamp, and a spoofed file size;
- and
- perform an action based on a policy in response to the unauthorized activity associated with the honeypot file or honeypot folder;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- detecting an unauthorized activity associated with a honeypot file or honeypot folder, wherein the honeypot file is a virtual file generated as a spoofed file system response using a filter driver or the honeypot folder is a virtual folder generated as the spoofed file system response using the filter driver, wherein the virtual file is dynamically generated using the filter driver with at least one of the following:
- a spoofed header, a spoofed time stamp, and a spoofed file size;
- and
- performing an action based on a policy in response to the unauthorized activity associated with the honeypot file or honeypot folder.
A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
- detecting an unauthorized activity associated with a honeypot file or honeypot folder, wherein the honeypot file is a virtual file generated as a spoofed file system response using a filter driver or the honeypot folder is a virtual folder generated as the spoofed file system response using the filter driver, wherein the virtual file is dynamically generated using the filter driver with at least one of the following:
- a spoofed header, a spoofed time stamp, and a spoofed file size;
- and
- performing an action based on a policy in response to the unauthorized activity associated with the honeypot file or honeypot folder.
Dependencies are inferred from the claim text.