US 12,111,929 B2 · Ransomware prevention

Abstract

Ransomware attacks may be prevented by monitoring file access requests. When a process requests a directory listing, the results provided may be modified based on whether the process is trusted or not. For trusted processes, the results provided are the actual directory listing, while the results provided to processes that aren't trusted may be modified to include seeded files. Access to the seeded files may be monitored to determine if the process is associated with a ransomware attack, and steps taken to mitigate an attempted ransomware attack. Ransomware may also be prevented by ensuring that only trusted processed are allowed to access certain files. In order to provide an improved user experience, the processes can be determined automatically from a system structure and their trustworthiness determined.

Claims33

Dependent claims

A method of preventing a ransomware attack comprising:

storing seeded files on a storage medium;
receiving at a file system an input/output (IO) request from a requesting process;
determining a trust classification of the requesting process based on whether the requesting process is a trusted process;
modifying results of the IO request based on the trust classification of the requesting process, wherein modifying the results comprises:
when the requesting process is untrusted, including the seeded files in the results provided to the requesting process, and
when the requesting process is trusted, removing the seeded files from the results provided to the requesting process;
and
monitoring one or more IO requests of the modified results from the requesting process when the requesting process is determined to have an untrusted trust classification.

5 more elements

Dependencies are inferred from the claim text.

Ransomware prevention

Life of this patent

Ransomware prevention

Life of this patent

Abstract

Claims33