Ransomware Protection For Cloud File Storage
AssigneeMcAfee, Inc.
InventorsSimon Hunt, Sean Tiernan
Life of this patent
Estimating the term…
Abstract
A cloud storage server-based approach allows detection of ransomware activity in cloud storage systems caused by ransomware infections on an endpoint device. A heuristic or rule-based technique is employed for recognizing sequences of file operations that may indicate ransomware activity. In some embodiments, users may be offered an opportunity to approve or disapprove of the possible ransomware activity. In others, cloud system file activity may be suspended or halted for the affected user upon recognition of possible ransomware actions. Enhanced recovery of files affected prior to recognition of the ransomware activity may be performed in some embodiments.
Claims25
A computer readable medium storing software for improving protection against ransomware by a cloud storage system, comprising instructions that when executed cause a cloud storage server to:
- hook into a cloud storage server application programming interface;
- intercept cloud storage server application programming interface calls for cloud storage operations requested by an endpoint device;
- record the requested cloud storage operations;
- analyze the recorded cloud storage operations to determine whether ransomware activity is occurring;
- and
- block ransomware activity on the cloud storage server responsive to the analysis.
A method of improving ransomware protection in cloud storage systems, comprising:
- intercepting application programming interface calls for cloud storage operations at a cloud storage server;
- recording cloud storage operations requested by an endpoint device;
- analyzing the recorded cloud storage operations;
- determining whether ransomware activity is indicated by the recorded cloud storage operations;
- and
- blocking ransomware activity on the cloud storage server responsive to the determination.
A cloud storage server programmed to block ransomware activity, comprising:
- a processing element;
- a memory, coupled to the processing element, on which is stored improved anti-ransomware protection software comprising instructions that when executed program the processing element to:
- hook into a cloud storage server application programming interface;
- intercept cloud storage operations requested by an endpoint device;
- record the requested cloud storage operations;
- analyze the recorded cloud storage operations to determine whether ransomware activity is occurring;
- and
- block ransomware activity responsive to the analysis.
Dependencies are inferred from the claim text.