Ransomware attack monitoring
AssigneeHewlett-Packard Development Company, L.P.
InventorsDaniel ELLAM, Adrian BALDWIN, Remy HUSSON
Life of this patent
Estimating the term…
Abstract
Examples associated with ransomware attack monitoring are described herein. One example includes a monitor module to monitor files stored on the system for sequences of file accesses that match a predefined pattern of file accesses. An investigation module is activated based on a sequence of file accesses that match the predefined pattern. The investigation module logs actions taken by processes to modify files. A reaction module pauses a set of processes operating on the system based on the logging performed by the investigation module, and resumes legitimate processes.
Claims20
A system, comprising:
- a monitor module with a lightweight detection module to:
- identify personal user files in a set of files on the system, wherein the set of files includes personal user files and system files, and
- monitor, via a hardware processor, some of the files on the system by the lightweight detection module to detect sequences of file accesses that match a predefined pattern of file accesses potentially associated with a suspected ransomware attack,
- wherein the files monitored by the lightweight detection module include files identified as personal user files and exclude files identified as system files;
- an investigation module to log actions taken by processes to modify the personal user files, where the investigation module is activated when a number of sequences of file accesses that match the predefined pattern exceeds a first threshold;
- and
- a reaction module to:
- pause a set of processes operating on the system,
- identify a paused process associated with the suspected ransomware attack based on the logging performed by the investigation module, and
- resume execution of processes not identified as associated with the suspected ransomware attack.
A method, comprising:
- distinguishing personal user files from system files stored on a device for monitoring;
- monitoring, via a monitor module executed on a hardware processor, the personal user files without monitoring the system files for sequences of file accesses that match a predefined pattern of file accesses of personal user files potentially associated with a ransomware attack;
- recording logging information regarding actions taken by processes to modify personal user files;
- and
- when the number of sequences of file accesses that match the predefined pattern exceeds a first threshold:
- pausing a set of processes operating on the device,
- identifying, from the logging information, a member of the set of paused processes that is taking actions indicative of the ransomware attack, and
- resuming a member of the set of suspicious processes that is not associated with the ransomware attack.
A system, comprising:
- a lightweight detection module to monitor, via a processor, personal user files on the system for a likelihood the system is experiencing a ransomware attack, with low impact on system usage due, at least in part, to the exclusion of system files from monitoring by the lightweight detection module;
- a heavyweight logging module to store information regarding suspicious processes while the lightweight detection module indicates that the system is likely experiencing the ransomware attack;
- and
- a reaction module to, when the lightweight detection module indicates that the system is experiencing the ransomware attack, impact system usage to:
- suspend suspicious processes,
- identify a suspicious process potentially associated with the ransomware attack using the stored information regarding the suspicious processes, and
- resume suspended processes unassociated with the ransomware attack.
Dependencies are inferred from the claim text.