Ransomware Protection for Cloud Storage Systems
AssigneeSpinbackup Inc.
InventorsDumitru Dontov, Mykola Klymenko
Life of this patent
Estimating the term…
Abstract
Exemplary security applications and systems are described herein. Such embodiments may be configured to provide backup functionality and ransomware protection for cloud storage systems. The described embodiments may monitor cloud storage systems to detect and classify various events. And the embodiments may perform any number of actions based on classified events, such as transmitting notifications to users, preventing a user or application from accessing the cloud storage system, and/or restoring infected files.
Claims20
A security system comprising:
- a cloud storage system storing a plurality of files;
- and
- a server in communication with the cloud storage system via a network, the server adapted to:
- receive, from the cloud storage system, during a first time period, file information for each of the plurality of files stored in the cloud storage system;
- generate and store, during the first time period, a backup file corresponding to each of the plurality of files stored in the cloud storage system;
- receive, from the cloud storage system, during a second time period, modified file information for each of a subset of files selected from the plurality of files;
- determine, based on the received modified file information, that a plurality of events have occurred during the second time period, each event associated with:
- a modified file selected from the subset of files;
- a file modification activity performed on the modified file;
- a time the file modification activity was performed;
- and
- a source of the file modification activity;
- determine that the plurality of events exceeds a predetermined event frequency threshold;
- determine that one of the modified files is an infected file based on the modified file information associated therewith;
- and
- replace the infected file in the cloud storage system with the corresponding stored backup file.
A method of providing ransomware protection for a cloud security system comprising:
- receiving, by a security system, during a first time period, file information for each of a plurality of files stored in a cloud storage system;
- generating and storing, by the security system, during the first time period, a backup file corresponding to each of the plurality of files stored in the cloud storage system;
- receiving, by the security system, during a second time period, modified file information for each of a subset of files selected from the plurality of files stored in the cloud storage system;
- determining, by the security system, based on the received modified file information, that a plurality of events have occurred during the second time period,
- wherein each of the plurality of events is associated with event information comprising:
- a modified file selected from the subset of files;
- a file modification activity performed on the modified file;
- a time the file modification activity was performed;
- and
- a source of the file modification activity;
- determining by the security system, an individual event risk score for each of the events;
- calculating, by the security system, an aggregate risk score for the plurality of events based on the individual event risk scores;
- classifying, by the security system, the plurality of events as a ransomware attack, based on the aggregate risk score;
- and
- performing, by the security system, an action based on said classifying.
Dependencies are inferred from the claim text.