Back to results
US 2019/0158512 A1Published application
Lightweight anti-ransomware system
AssigneeFortinet, Inc.
InventorJie Zhang
Life of this patent
Estimating the term…
Abstract
Systems and methods for detecting ransomware are provided. According to one embodiment, a computer device intercepts an operation on a file by an application and determines whether the application is ransomware based on one or more factors. The computer device mitigates the operation to the file when the application is deemed to be ransomware.
Claims24
A method comprising:
- intercepting, by an anti-virus engine running on a computer system, an operation attempting to be performed on a file by an application;
- determining, by the anti-virus engine, whether the application is ransomware based on one or more factors, including:
- whether the application is a designated application for the file or a type of the file;
- and
- whether a number of file operations performed by the application in a predetermined time period exceeds a predetermined or configurable operation count threshold;
- and
- when a result of said determining is affirmative, then mitigating, by the anti-virus engine, potential adverse consequences of the operation on the file.
4 more elements
A computer system comprising:
- a non-transitory storage device having embodied therein one or more routines representing a client security application;
- and
- one or more processors coupled to the non-transitory storage device and operable to execute the client security manager to perform a method comprising:
- intercepting an operation attempting to be performed on a file by an application;
- determining whether the application is ransomware based on one or more factors, including:
- whether the application is a designated application for the file or a type of the file;
- and
- whether a number of file operations performed by the application in a predetermined time period exceeds a predetermined or configurable operation count threshold;
- and
- when a result of said determining is affirmative, then mitigating potential adverse consequences of the operation on the file.
7 more elements
Dependencies are inferred from the claim text.