Method and System for Mitigating the Effects of Ransomware
AssigneeCheck Point Software Technologies Ltd.
InventorsKasif DEKEL, Liad MIZRACHI, Roman ZAIKIN, Oded VANUNU
Life of this patent
Estimating the term…
Abstract
Computerized methods and systems mitigate the effect of a ransomware attack on an endpoint by detecting access events associated with requests by processes, including ransomware processes, to access data items on the endpoint. The data items are hidden from the operating system processes executed on the endpoint. In response to detecting an access event, an action is taken against the process associated with the access event.
Claims23
A method for mitigating the effect of a ransomware attack on an endpoint, comprising:
- detecting at least one access event associated with a request by a process to access at least one data item deployed in a file directory on the endpoint, the at least one data item being hidden from operating system processes executed on the endpoint, and the at least one data item, for which the access request was made, including data for baiting a ransomware process to access the at least one data item, such that, the ransomware process is the first process to request access to the at least one data item, and the at least one data item is the first data item in the file directory for which the ransomware process requests access;
- and
- responding to the detecting of the at least one access event by taking at least one action against the process associated with the detected access event.
(canceled)
(canceled)
A computer system for mitigating the effect of a ransomware attack on an endpoint, comprising:
- a non-transitory computer readable storage medium for storing computer components;
- and
- a hardware processor for executing the computer components comprising:
- a computer module configured for:
- detecting at least one access event associated with a request by a process to access at least one data item deployed in a filed directory on the endpoint, the at least one data item being hidden from operating system processes executed on the endpoint, and the at least one data item, for which the access request was made, including data for baiting a ransomware process to access the at least one data item, such that, the ransomware process is the first process to request access to the at least one data item, and the at least one data item is the first data item in the file directory for which the ransomware process requests access;
- and
- responding to the detecting of the at least one access event by taking at least one action against the process associated with the detected access event.
18-21. (canceled)
A method for mitigating the effect of a ransomware attack on an endpoint, comprising:
- deploying a plurality of files in a plurality of file directories on the endpoint, each of the deployed files being hidden from operating system processes executed on the endpoint and including data for baiting a ransomware process to access the deployed file, the deploying based on a protection priority assigned to the file directories and user files in the file directories, the protection priority derived from the quantity and frequency of historical accesses, by a user of the endpoint, to the file directories and user files in the file directories;
- detecting at least one access event associated with a request by a process to access at least one of the deployed files on the endpoint;
- and
- responding to the detecting of the at least one access event by taking at least one action against the process associated with the detected access event.
Dependencies are inferred from the claim text.