Back to results
US 2018/0293379 A1Published application
System and Method for Blocking Ransomware Infections
AssigneeBlock Ransomware, LLC
InventorAsher Dahan
Life of this patent
Estimating the term…
Abstract
The present disclosure is directed to a ransomware detection component or an anti-ransomware application that detects, stops, and removes ransomware from a computing system. In one embodiment, the anti-ransomware application may prevent new ransomware from infecting one or more components of the system or remove or disable existing ransomware that is already present on the system.
Claims20
A system for mitigating the effects of ransomware attacks, comprising:
- a plurality of computing devices interconnected via a network;
- a plurality of storage devices, wherein each storage device is configured to store a plurality of data files in a plurality of file directories, wherein a select number of the plurality of storage devices include at least one shared file directory for storing a plurality of data files therein, wherein each shared file directory is configured to allow access to data files stored therein to a select number of the plurality of computing devices via the network;
- a ransomware detection component connected to a select number of the plurality of computing devices and storage devices via the network, wherein the ransomware detection component is configured to detect possible ransomware attacks and comprises,
- a honeypot deployment module configured to selectively deploy a plurality of honeypot data items into a select number of the plurality of storage devices, wherein a select number of the plurality of deployed honeypot data items are accessible to selected users of the system, wherein the honeypot data items comprise honeypot drives, honeypot files, and combinations thereof;
- a monitoring module configured to
- monitor a plurality of activities executed on data files stored in a select number of the plurality of storage devices,
- detect activities executed on data files that conform to at least one of a predefined set of activities, and
- generate a plurality of event data associated with each detected activity;
- a trigger rule module configured to determine, based on event data associated with each detected activity, whether a detected activity is indicative of a ransomware attack by a third party not authorized to execute such detected activity;
- an action script module configured to execute, based on a determination by the trigger rule module that a detected activity is indicative of a ransomware attack, at least one action script to mitigate access to shared data files should the detected activity be a ransomware attack;
- and
- a database module configured to store at least a portion of event data associated with detected activities.
9 more elements
A system for mitigating the effects of ransomware attacks, comprising:
- a plurality of computing devices interconnected via a network;
- a plurality of storage devices, wherein each storage device is configured to store a plurality of data files in a plurality of file directories, wherein a select number of the plurality of storage devices include at least one shared file directory for storing a plurality of data files therein, wherein each shared file directory is configured to allow access to data files stored therein to a select number of the plurality of computing devices via the network;
- a plurality of ransomware detection components, wherein each ransomware detection component is connected to a select number of the plurality of computing devices and storage devices via the network, wherein each ransomware detection component is operable to detect possible ransomware attacks and comprises:
- a honeypot deployment module configured to selectively deploy a plurality of honeypot data items into a select number of the plurality of storage devices, wherein a select number of the plurality of deployed honeypot data items are accessible to selected users of the system, wherein the honeypot data items comprise honeypot drives, honeypot files, and combinations thereof;
- at least one monitoring module configured to
- monitor a plurality of activities executed on data files stored in the plurality of storage devices,
- detect activities executed on data files that conform to at least one of a predefined set of activities, and
- generate a plurality of event data associated with each detected activity;
- a trigger rule module configured to
- determine, based on event data associated with each detected activity, whether a detected activity is indicative of a ransomware attack by a third party not authorized to execute such detected activity, and
- generate a plurality of event analysis data therefrom;
- an action script module configured to execute, based on a determination by the trigger rule module that a detected activity is indicative of a ransomware attack, at least one action script to mitigate access to shared data files should the detected activity be a ransomware attack;
- a database module configured to store at least a portion of event data associated with detected activities;
- and
- an input/output device configured to exchange at least a portion of least one of event data associated with detected activities, event analysis data, at least one action script, status update messages, and combinations thereof with a select number of a remainder of the plurality of ransomware detection components via the network.
12 more elements
A method for mitigating the effects of ransomware attacks within a networked system, wherein the system comprises
- (a) a plurality of computing devices interconnected via a network,
- (b) a plurality of storage devices, wherein each storage device is configured to store a plurality of data files in a plurality of file directories, wherein a select number of the plurality of storage devices include at least one shared file directory for storing a plurality of data files therein, wherein each shared file directory is configured to allow access to data files stored therein to a select number of the plurality of computing devices via the network, and
- (c) a ransomware detection component connected to a select number of the plurality of computing devices and storage devices via the network for detecting possible ransomware attacks, wherein the ransomware detection component comprises (i) a honeypot deployment module, (ii) a monitoring module, (iii) a trigger rule module, (iv) an action script module, and (v) a database module, the method comprising:
- deploying, via the honeypot deployment module, a plurality of honeypot data items into a select number of the plurality of storage devices, wherein a select number of the plurality of deployed honeypot data items are accessible to selected users of the system, wherein the honeypot data items comprise honeypot drives, honeypot files, and combinations thereof;
- monitoring, via the monitoring module, a plurality of activities executed on data files stored in a select number of the plurality of storage devices,
- detecting, via the monitoring module, activities executed on data files that conform to at least one of a predefined set of activities, and generating a plurality of event data associated with each detected activity;
- determining, via the trigger rule module, based on event data associated with each detected activity, whether a detected activity is indicative of a ransomware attack by a third party not authorized to execute such detected activity, and generating a plurality of event analysis data therefrom;
- and
- executing, via the action script module, based on a determination by the trigger rule module that a detected activity is indicative of a ransomware attack, at least one action script to mitigate access to shared data files should the detected activity be a ransomware attack.
6 more elements
Dependencies are inferred from the claim text.