Detecting ransomware among files using information that is not included in content of the files

A method of detecting ransomware among a plurality of files using information that is not included in content of the plurality of files, the method implemented by a computing system, the method comprising:

• determining the plurality of files, which is stored among a plurality of directories, based at least in part on a file-related operation being performed on each of the plurality of files during a session of a cloud-based application, the session defined by a period of time between a start time and an end time;
• determining a subset of the plurality of files such that each file in the subset has multiple file extensions during the session;
• comparing a value, which is based at least in part on a number of the files in the subset, to a threshold;
• detecting that the plurality of files includes the ransomware based at least in part on the value being greater than or equal to the threshold;
• determining a number of the files in the subset that are stored in each of the plurality of directories;
• for each of the plurality of directories, comparing a respective second value, which is based at least in part on a number of the files in the subset that are stored in the respective directory, to a second threshold;
• identifying each directory that includes at least a portion of the ransomware based at least in part on the respective second value of the respective directory being greater than or equal to the second threshold;
• and
• triggering an alert, which indicates that the plurality of files includes the ransomware and that indicates each directory that includes at least a portion of the ransomware, based at least in part on detecting that the plurality of files includes the ransomware.

A computer program product comprising a computer-readable storage medium having instructions recorded thereon for enabling a processor-based system to perform operations to detect ransomware among a plurality of files using information that is not included in content of the plurality of files, the operations comprising:

• determining the plurality of files based at least in part on a file-related operation being performed on each of the plurality of files during a session of a cloud-based application, the session defined by a period of time between a start time and an end time;
• determining a subset of the plurality of files such that each file in the subset has multiple file extensions during the session, said determining of the subset comprising:
• determining that a first file has a multiple-concatenated file extension during the session;
• determining that the multiple-concatenated file extension has an inner extension that is used as an extension for a file during a plurality of sessions a number of times that is greater than or equal to a first threshold number of times;
• and
• determining that the multiple-concatenated file extension has an outer extension that is used as an extension for a file during the plurality of sessions a number of times that is less than or equal to a second threshold number of times;
• comparing a value, which is based at least in part on a number of the files in the subset, to a third threshold;
• detecting whether the plurality of files includes the ransomware based at least in part on whether the value is greater than or equal to the third threshold;
• and
• selectively triggering an alert, which indicates that the plurality of files includes the ransomware, based at least in part on detection of whether the plurality of files includes the ransomware.