System and method for preventing and mitigating malicious processes by analyzing live data

A system for preventing or mitigating malicious processes in a computing environment, comprising:

• one or more processors and memory operatively coupled to the one or more processors, wherein the memory includes computer instructions and a kernel driver of an operating system for the computing environment which when executed by the one or more processors causes the one or more processors to perform the operations of:
• intercepting all file system input and output paths using the kernel driver;
• analyzing behaviors in real time on data being processed through the input and output paths and data access patterns on a live system implemented in the kernel of the operating system for the computing environment by:
• determining if the data written by an application is clear or encrypted;
• finding repeated runs of data;
• detecting any data modification;
• monitoring frequent reads and writes from an application;
• monitoring the file operations for any destructive operation;
• monitoring for any corruption of headers, file formats, or signatures;
• flagging the data for any of the aforementioned behaviors;
• and
• preventing further processing upon detection of the one or more aforementioned behaviors,
• wherein the system further uses a waterfall approach to prevent false alerts of ransomware by maintaining entropy and benchmark heuristics of false hits of normal writes that appear encrypted, actual ransomware encrypted writes, and clear reads as part of a module for detected encrypted data in writes and by taking measurements of clear reads, clear writes, file deletes, and other measurements to create a malice score, wherein a score exceeding a sensitivity adjusted threshold indicates the presence of ransomware.

A method for preventing or mitigating malicious processes in a computing environment having one or more processors and memory operatively coupled to the one or more processors, wherein the memory includes computer instructions which when executed by the one or more processors causes the one or more processors to perform the operations of:

• intercepting all file system input and output paths using a kernel driver;
• analyzing for suspect behaviors in real time on data being processed through the input and output paths and data access patterns on a live system implemented in a kernel of an operating system for the computing environment;
• flagging the data for any suspect behaviors;
• and
• preventing further processing upon detection of the suspect behaviors,
• wherein the method further uses a waterfall approach to prevent false alerts of ransomware by maintaining entropy and benchmark heuristics of false hits of normal writes that appear encrypted, actual ransomware encrypted writes, and clear reads as part of a module for detected encrypted data in writes and by taking measurements of clear reads, clear writes, file deletes, and other measurements to create a malice score, wherein a score exceeding a sensitivity adjusted threshold indicates the presence of ransomware.