System and method for detecting malware that interferes with the user interface

A system for detecting ransomware, the system comprising:

• computing hardware including a processor and data store, a user input device and a display device;
• an operating system executable on the computing hardware and comprising instructions stored in a non-transitory storage medium that, when executed, implement a user interface module that operationally communicates with the user input device and the display device;
• a user input monitoring module executable on the computing hardware and comprising instructions stored in a non-transitory storage medium that, when executed, cause the computing hardware to collect a current user behavior pattern based on user input via the user input device;
• an input data analysis module executable on the computing hardware and comprising instructions stored in a non-transitory storage medium that, when executed, cause the computing hardware to compare the user behavior against a reference set of behavior patterns associated with user frustration with non-responsiveness of the user interface module;
• an operating system status analysis module executable on the computing hardware and comprising instructions stored in a non-transitory storage medium that, when executed, cause the computing hardware to compare a current status pattern of the operating system against a reference set of operating system status patterns associated with predefined ransomware behavior;
• a decision module executable on the computing hardware and comprising instructions stored in a non-transitory storage medium that, when executed, cause the computing hardware to provide an indication of a positive detection of ransomware executing on the computer system in response to an output of the input data analysis module being indicative of current user frustration with non-responsiveness of the user interface module, and further in response to an output of the operating system status analysis module being indicative of the current status pattern having a correlation to the predefined ransomware behavior.