Back to results
US 11,768,936 B2Granted
Anomaly-based ransomware detection for encrypted files
AssigneeEMC IP Holding Company LLC
InventorsOr Herman Saffar, Amihai Savir
Life of this patent
Estimating the term…
Abstract
Techniques are provided for anomaly-based ransomware detection of encrypted files. One exemplary method comprises obtaining metadata for an encrypted file; applying an anomaly detection technique to the metadata to compare at least one attribute in the metadata to one or more corresponding historical baseline values for the at least one attribute; and determining whether the encrypted file comprises a ransomware encryption based on the comparison. In some embodiments, one or more of file extension attributes, file size attributes and file name attributes in the metadata are compared to the one or more corresponding historical baseline values to identify a ransomware attack.
Claims20
A method, comprising:
- performing the following steps, in response to receiving an encrypted file, secured by a first encryption, sent from a user to a backup service as part of a backup of the encrypted file;
- obtaining metadata for the encrypted file, wherein the metadata comprises a file name extension attribute of the encrypted file;
- applying, using at least one processing device of the backup service, an anomaly detection technique to the metadata to compare at least one attribute in the metadata to one or more corresponding historical baseline values for the at least one attribute, wherein the anomaly detection technique comprises a machine learning technique that employs at least one trained machine learning model that is trained using historical time-series data for each of a plurality of file types each having a corresponding file name extension attribute;
- and
- determining, using the at least one processing device of the backup service, whether the encrypted file, secured by the first encryption, was also encrypted using a ransomware encryption, in addition to the first encryption, based at least in part on the comparison, wherein the ransomware encryption is distinct from the first encryption, wherein the comparison comprises a comparison of (i) a count of files in a repository having the file name extension attribute of the encrypted file to (ii) a corresponding historical baseline value of the count of files in the repository having the file name extension attribute of the encrypted file to identify the ransomware encryption based at least in part on a deviation from an expected file name extension distribution.
2 more elements
A system, comprising:
- a memory;
- and
- at least one processing device, coupled to the memory, operative to implement the following steps:
- performing the following steps, in response to receiving an encrypted file, secured by a first encryption, sent from a user to a backup service as part of a backup of the encrypted file;
- obtaining metadata for the encrypted file, wherein the metadata comprises a file name extension attribute of the encrypted file;
- applying, using at least one processing device of the backup service, an anomaly detection technique to the metadata to compare at least one attribute in the metadata to one or more corresponding historical baseline values for the at least one attribute, wherein the anomaly detection technique comprises a machine learning technique that employs at least one trained machine learning model that is trained using historical time-series data for each of a plurality of file types each having a corresponding file name extension attribute;
- and
- determining, using the at least one processing device of the backup service, whether the encrypted file, secured by the first encryption, was also encrypted using a ransomware encryption, in addition to the first encryption, based at least in part on the comparison, wherein the ransomware encryption is distinct from the first encryption, wherein the comparison comprises a comparison of (i) a count of files in a repository having the file name extension attribute of the encrypted file to (ii) a corresponding historical baseline value of the count of files in the repository having the file name extension attribute of the encrypted file to identify the ransomware encryption based at least in part on a deviation from an expected file name extension distribution.
5 more elements
A computer program product, comprising a tangible machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps:
- performing the following steps, in response to receiving an encrypted file, secured by a first encryption, sent from a user to a backup service as part of a backup of the encrypted file;
- obtaining metadata for the encrypted file, wherein the metadata comprises a file name extension attribute of the encrypted file;
- applying, using at least one processing device of the backup service, an anomaly detection technique to the metadata to compare at least one attribute in the metadata to one or more corresponding historical baseline values for the at least one attribute, wherein the anomaly detection technique comprises a machine learning technique that employs at least one trained machine learning model that is trained using historical time-series data for each of a plurality of file types each having a corresponding file name extension attribute;
- and
- determining, using the at least one processing device of the backup service, whether the encrypted file, secured by the first encryption, was also encrypted using a ransomware encryption, in addition to the first encryption, based at least in part on the comparison, wherein the ransomware encryption is distinct from the first encryption, wherein the comparison comprises a comparison of (i) a count of files in a repository having the file name extension attribute of the encrypted file to (ii) a corresponding historical baseline value of the count of files in the repository having the file name extension attribute of the encrypted file to identify the ransomware encryption based at least in part on a deviation from an expected file name extension distribution.
2 more elements
Dependencies are inferred from the claim text.