Methods for behavioral detection and prevention of cyberattacks, and related apparatus and techniques

A computer system comprising:

• one or more processing devices and one or more storage devices storing instructions that are operable, when executed by the processing devices, to cause the processing devices to perform operations including:
• based on first events initiated by a computational entity in a computer system, detecting one or more instances of the computational entity engaging in one or more first behaviors associated with one or more storage resources of the computer system;
• assigning at least one potential ransomware category to the computational entity based on the detected instances of the first behaviors;
• based on the assigning of the at least one potential ransomware category, determining Whether the computational entity comprises a plurality of related computational units;
• upon determining that the computational entity comprises the plurality of related computational units, identifying an effective actor within the plurality of related computational units at least by traversing a hierarchy of the plurality of related computational units and identifying a computational unit in the hierarchy, that is neither an operating system (OS) component nor a verified application, as the effective actor;
• assigning a threat score, to the computational entity based on the assigned potential ransomware category and the effective actor;
• determining whether the assigned threat score exceeds a threshold score associated with a protection policy;
• and
• upon the assigned threat scare exceeding the threshold score, applying the protection policy to the identified computational entity to protect the computer system.

One or more non-transitory computer readable media embodying instructions for ransomware detection, that when executed by at least one processor, cause the at least one processor to:

• based on first events initiated by a computational entity in a computer system, detect one or more instances of the computational entity engaging in one or more first behaviors associated with one or more storage resources of the computer system;
• assign at least one potential ransomware category to the computational entity based the detected instances of the first behaviors;
• based on the assigning of the at least one potential ransomware category, determine whether the computational entity comprises a plurality of related computational units;
• upon determining that the computational entity comprises the plurality of related computational units, identify an effective actor within the plurality of related computational units at least by traversing a hierarchy of the plurality of related computational units and identifying a computational unit in the hierarchy, that is neither an operating system (OS) component nor a verified application, as the effective actor;
• assign a threat score to the computational entity based on the assigned potential ransomware category and the effective actor;
• determine whether the assigned threat score exceeds a threshold score associated with a protection policy;
• and
• upon the assigned threat score exceeding the threshold score, apply the protection policy to the identified computational entity to protect the computer system.