Detection of ransomware
AssigneeMcAfee, Inc.
InventorsOliver G. Devane, Abhishek Karnik, Sriram P
Life of this patent
Estimating the term…
Abstract
An apparatus, including systems and methods, for detecting ransomware is disclosed herein. For example, in some embodiments, an apparatus includes a memory element operable to store instructions; and a processor operable to execute the instructions, such that the apparatus is configured to receive data identifying a process and a plurality of files accessed by the process; identify an access indicator associated with each of the plurality of files accessed by the process, wherein the access indicator includes file type; determine whether the access indicator exceeds a threshold; interrupt, based on a determination that the access indicator exceeds a threshold, the process; and prompt a user to allow or disallow the process to proceed.
Claims18
An apparatus, comprising:
- a memory element operable to store instructions;
- and
- a processor operable to execute the instructions, such that the apparatus is configured to:
- receive data identifying a process and a plurality of files accessed by the process;
- identify a first access indicator of a plurality of access indicators for each of the plurality of files accessed by the process, wherein the first access indicator is a file type;
- identify a second access indicator of the plurality of access indicators for each of the plurality of files accessed by the process, wherein the plurality of access indicators are selected from the group consisting of the file type, an age of a file that was accessed, a number of files per file type that were accessed, and a frequency that files were accessed;
- based on a determination that a first threshold based on the first access indicator is satisfied, determine whether a second threshold based on the second access indicator of the plurality of access indicators is satisfied, wherein the first threshold is defined by exceeding at least five file types;
- interrupt, based on a determination that the second threshold is satisfied, the process;
- and
- prompt a user to allow or disallow the process to proceed.
At least one non-transitory computer-readable medium comprising one or more instructions that, when executed by a processor, cause the processor to:
- monitor a process accessing a plurality of files;
- identify a first access indicator of a plurality of access indicators for each of the plurality of files accessed by the process, wherein the first access indicator is a file type;
- identify a second indicator of the plurality of access indicators associated with each of the plurality of files accessed by the process, wherein the plurality of access indicators are selected from the group consisting of the file type, an age of a file that was accessed, a number of files per file type that were accessed, and a frequency that files were accessed;
- store the plurality of access indicators identified for each of the plurality of files accessed by the process;
- based on a determination that a first threshold based on the first access indicator is satisfied, determine whether a second threshold based on the second access indicator of the plurality of access indicators is satisfied, wherein the first threshold is defined by exceeding at least five file types;
- interrupt, based on a determination that the second threshold is satisfied, the process;
- and
- prompt a user to allow or disallow the process to proceed.
A method, comprising:
- receiving data identifying a process and a plurality of files accessed by the process;
- identifying a first access indicator of a plurality of access indicators for each of the plurality of files accessed by the process, wherein the first access indicator is a file type;
- identifying a second access indicator of the plurality of access indicators associated with each of the plurality of files accessed by the process, wherein the plurality of access indicators are selected from the group consisting of the file type, an age of a file that was accessed, a number of files per file type that were accessed, and a frequency that files were accessed;
- based on a determination that a first threshold based on the first access indicator is satisfied, determining whether a second threshold based on the second access indicator of the plurality of access indicators is satisfied, wherein the first threshold is defined by exceeding at least five file types;
- interrupting, based on a determination that the second threshold is satisfied, the process;
- and
- prompting a user to allow or disallow the process to proceed.
Dependencies are inferred from the claim text.