System and method for detection of malware or ransomware using entropy quantification

A system for detecting and preventing or mitigating malicious processes in a computing environment, comprising:

• one or more processors and memory operatively coupled to the one or more processors, wherein the memory includes computer instructions which when executed by the one or more processors causes the one or more processors to perform the operations of:
• obtain all file system input and output paths using a kernel-level driver;
• monitor, at run time by an anomaly-based file system monitor implemented in the kernel-level driver, file system read and write operations issued by executing processes, comprising data conveyed on input and output paths of the file system, as run-time behavioral data of the executing processes;
• perform in real time a normalized entropy quantification calculation on content-based bytes of data read from and written to found on the file system by the executing processes found on the input and output paths to characterize run-time file transformation behavior;
• determine an inverse density from the normalized quantification entropy calculation by
• separating the bytes of data into bins corresponding to each symbol of a fixed alphabet;
• arranging the bins in an ascending order of frequency;
• computing an area under a distribution curve defined by the arranged bins;
• determining a height of an ideal distribution occupying the area computed to provide an ideal height;
• computing an absolute difference between the distribution curve and the ideal height at each point along an X-axis;
• computing a cumulative deviation based on the absolute difference;
• computing a cumulative mean deviation from the cumulative deviation;
• and
• computing a percentage of the cumulative mean deviation relative to the ideal height to produce the inverse density;
• and
• flag an executing process as malicious when a difference between inverse densities computed for bytes associated with read operations and bytes associated with write operations exceeds a predetermined threshold indicative of anomalous file transformation behavior.

A method for detecting and preventing or mitigating malicious processes in a computing environment using one or more processors and memory operatively coupled to the one or more processors, wherein the memory includes computer instructions which when executed by the one or more processors causes the one or more processors to perform the operations of:

• obtaining all file system input and output paths using a kernel-level driver;
• monitoring, at run time by an anomaly-based file system monitor implemented in the kernel-level driver, file system read and write operations issued by executing processes, comprising data conveyed on input and output paths of the file system, as run-time behavioral data of the executing processes:
• performing in real time a normalized entropy quantification calculation on content-based bytes of data read from and written to the file system by the executing processes found on the input and output paths to characterize run-time file transformation behavior;
• determining an inverse density from the normalized entropy calculation by separating the bytes into bins corresponding to each symbol of a fixed alphabet:
• arranging the bins in an ascending order of frequency;
• computing an area under a distribution curve defined by the arranged bins;
• determining an ideal height of an idealized uniform distribution occupying the computed area;
• computing an absolute difference between the distribution curve and the ideal height at each point along an X-axis:
• computing a cumulative deviation based on the absolute differences:
• computing a cumulative mean deviation from the cumulative deviation;
• and
• computing a percentage of the cumulative mean deviation relative to the ideal height to produce the inverse density;
• and
• flagging an executing process as malicious when a difference between inverse densities computed for bytes associated with read operations and bytes associated with write operations exceeds a predetermined threshold indicative of anomalous file transformation behavior.