Ransomware prevention
AssigneeField Effect Software Inc.
InventorMatthew Holland
Life of this patent
Estimating the term…
Abstract
Ransomware attacks may be prevented by monitoring file access requests. When a process requests a directory listing, the results provided may be modified based on whether the process is trusted or not. For trusted processes, the results provided are the actual directory listing, while the results provided to processes that aren't trusted may be modified to include seeded files. Access to the seeded files may be monitored to determine if the process is associated with a ransomware attack, and steps taken to mitigate an attempted ransomware attack. Ransomware may also be prevented by ensuring that only trusted processed are allowed to access certain files. In order to provide an improved user experience, the processes can be determined automatically from a system structure and their trustworthiness determined.
Claims12
A method of preventing a ransomware attack comprising:
- processing a system structure to automatically determine a file type to process mapping between a plurality of file types and processes used in accessing respective ones of the plurality of file types, wherein processing the system structure to automatically determine the file type to process mapping comprises:
- using an API to identify a plurality of Uniform Type Identifiers (UTIs) on a given host;
- and
- correlating UTI mappings to the registered applications or bundles that support them;
- for each of the processes in the file type to process mapping, evaluating a trustworthiness of the process;
- receiving at a file system an input/output (IO) request from a requesting process;
- determining if the requesting process is a trusted process;
- and
- allowing or blocking the IO request based on the determination of if the requesting process is trusted.
A system for preventing a ransomware attack comprising:
- a processor for executing instructions;
- and
- a memory for storing instructions, which when executed by the processor, configure the system to perform a method comprising:
- processing a system structure to automatically determine a file type to process mapping between a plurality of file types and processes used in accessing respective ones of the plurality of file types, wherein processing the system structure to automatically determine the file type to process mapping comprises:
- using an API to identify a plurality of Uniform Type Identifiers (UTIs) on a given host;
- and
- correlating UTI mappings to the registered applications or bundles that support them;
- for each of the processes in the file type to process mapping, evaluating a trustworthiness of the process;
- receiving at a file system an input/output (IO) request from a requesting process;
- determining if the requesting process is a trusted process;
- and
- allowing or blocking the IO request based on the determination of if the requesting process is trusted.
A non-transitory computer readable media having encoded thereon instructions that, when executed by a processor of a computer system, configure the computer system to perform a method comprising:
- processing a system structure to automatically determine a file type to process mapping between a plurality of file types and processes used in accessing respective ones of the plurality of file types, wherein processing the system structure to automatically determine the file type to process mapping comprises:
- using an API to identify a plurality of Uniform Type Identifiers (UTIs) on a given host;
- and
- correlating UTI mappings to the registered applications or bundles that support them;
- for each of the processes in the file type to process mapping, evaluating a trustworthiness of the process;
- receiving at a file system an input/output (IO) request from a requesting process;
- determining if the requesting process is a trusted process;
- and
- allowing or blocking the IO request based on the determination of if the requesting process is trusted.
Dependencies are inferred from the claim text.