Method and apparatus for ransomware detection

An apparatus, comprising

• a memory;
• and
• a processor configured:
• to store, in the memory, a set of malware detection rules for a set of respective storage entities, each given rule indicating, when applied to a request to write to a given respective storage entity, whether the request originates from one or more malware applications that corrupts the storage entities,
• to receive a new request to write data to a given storage entity,
• to identify, from the set of malware detection rules, a given malware detection rule corresponding to the given storage entity,
• to apply the identified malware detection rule to the received new request so as to detect that the computer is infected with a given malware application, and
• to initiate a responsive action upon detecting the given malware application infection.

A computer software product, the product comprising a non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a computer, cause the computer:

• to store, in a memory, a set of malware detection rules for a set of respective storage entities, each given rule indicating, when applied to a request to write to a given respective storage entity, whether the request originates from one or more malware applications that corrupts the storage entities;
• to receive a new request to write data to a given storage entity;
• to identify, from the set of malware detection rules, a given malware detection rule corresponding to the given storage entity;
• to apply the identified malware detection rule to the received new request so as to detect that the computer is infected with a given malware application;
• and
• to initiate a responsive action upon detecting the given malware application infection.