US 2018/0324214 A1 · Crypto-Ransomware Compromise Detection

Abstract

A memory system includes a controller having a processor and one or more memory media, and a method of operating the memory system. A host generates honeypot files and the processor is configured to write the honeypot files onto the memory media at random locations. The controller monitors the locations of the randomly distributed honeypot files for access. The host may set a mode of operation concerning access of the honeypot files randomly distributed on the memory media. In a strict mode of operation, the controller may halt access to the memory media or require authentication if a single honeypot file is accessed. In a moderate mode of operation, the controller may analyze the memory media to determine if under attack if a single honeypot file is accessed. In a light mode of operation, the controller may not take any action until a predetermined number of honeypot files are accessed.

Claims25

Dependent claims

A method of operating a memory system comprising:

writing a first plurality of files onto a memory media, wherein the first plurality of files are randomly distributed to locations of the memory media;
recording a mode of operation of the memory media;
recording each location on the memory media for each of the randomly distributed first plurality of files;
monitoring the randomly distributed first plurality of files for access;
and
taking an action based upon the recorded mode of operation when one of the randomly distributed plurality of files is accessed.

3 more elements

A method of protecting memory media from crypto-ransomware comprising:

generating a graphical user interface (GUI) that accepts user-selectable inputs for a percentage of a storage of a memory media to fill, and a level of crypto-ransomware monitoring;
receiving the user-selectable input for the percentage of the storage of the memory media to fill and, in response, generating a plurality of honeypot files with random file names, random sizes, and random file types, wherein the size of the generated plurality of honeypot files in total equals the user-selectable input for the percentage of the storage of the memory media to fill;
receiving the user-selectable input for the level of crypto-ransomware monitoring and, in response, generating a mode of operation command for a controller of the memory media corresponding to the received input for the level of crypto-ransomware monitoring;
issuing the mode of operation command to the controller of the memory media, and a command to the controller of the memory media to initiate a transfer of the generated plurality of honeypot files to random locations in the storage of the memory media;
receiving an acknowledgement from the controller of the memory media that the transfer of the honeypot files will occur and that the mode of operation for the controller of the memory media has been recorded;
and
transferring the honeypot files to the controller to be stored at random locations in the storage of the memory media.

4 more elements

Dependencies are inferred from the claim text.

Crypto-Ransomware Compromise Detection

Life of this patent

Crypto-Ransomware Compromise Detection

Life of this patent

Abstract

Claims25