Antiransomware Using Machine Learning

A method comprising:

• monitoring access to executables and/or dynamic linked libraries (DLL) across various nodes of a distributed computing environment;
• extracting one or more features from each accessed executable and/or DLL;
• inputting the extracted features into at least one machine learning model to generate a suspiciousness score for each accessed executable and/or DLL, the at least one machine learning model being trained to determine whether the executable file comprises ransomware;
• determining, using the extracted features and the suspiciousness score, an execution chain of trust score for each executable and/or DLL characterizing one or more associated parent processes;
• and
• initiating one or more ransomware countermeasures when one or both of the suspiciousness score and the execution chain of trust score are above a pre-determined threshold.

A method comprising:

• receiving data comprising or characterizing an executable;
• extracting one or more features from the received data indicative of each of:
• an execution chain of trust characterizing one or more events preceding a requested execution event;
• and
• a presence of a suspiciousness indicators;
• inputting the extracted features into at least one machine learning model trained to determine whether the executable comprises ransomware;
• preventing the executable from executing or continuing to execute based on a determination that the executable comprises ransomware;
• and
• allowing the executable to execute or continue to execute based on a determination that the executable does not comprise ransomware.

A method comprising:

• monitoring, for each of a plurality of nodes forming part of a computing environment, accesses to executables;
• extracting, for each executable, one or more features indicative of each of:
• an execution chain of trust characterizing one or more events preceding a requested execution event;
• a presence of a suspiciousness indicators;
• and
• events surrounding the access of the executable;
• inputting, for each executable, the extracted features into at least one machine learning model trained to determine whether the executable comprises ransomware;
• preventing, for each executable, the executable from executing or continuing to execute based on a determination that the executable comprises ransomware;
• and
• allowing, for each executable, the executable to execute or continue to execute based on a determination that the executable does not comprise ransomware.

A system comprising:

• at least one data processor;
• and
• memory storing instructions which, when executed by the at least one data processor, executes operations comprising:
• receiving data comprising or characterizing an executable and/or dynamic linked library (DLL);
• extracting one or more features from the executable and/or DLL;
• inputting the extracted features into at least one machine learning model to generate a suspiciousness score, the at least one machine learning model being trained to determine whether the executable file comprises ransomware;
• determining, using the extracted features and the suspiciousness score, an execution chain of trust score for the executable and/or DLL characterizing one or more associated parent processes;
• and
• initiating, based on the suspiciousness score and the execution chain of trust score, one or more ransomware countermeasures.