File Integrity Assessment to Detect Malware

Abstract

There is a need for better protection against ransomware attacks. This is achieved by providing a method (100) of assessing the integrity of files (1, 2, 3) comprising the steps: continually monitoring (111) files of a file system (10) for malware (10), detecting (112) an updated file (1) such as a modified file or a created file, the updated file emerging from an update event, screening (113) file parameters (121) of the updated file, where if file parameters are within predetermined bounds, the file is marked as integrous and wherein alternatively in response to a file parameter (121) having an anomaly transgressing a predefined anomaly threshold, deep inspecting (120) the updated file (1), the deep inspection (120) comprising: retrieving, from a database, a sequence of tests (122) specific to the file parameter (121) anomaly of the updated file (1), testing the updated file (1) using the sequence of tests (122) where the sequence of tests (122) ascertains file integrity related to the updated file (1) and the update event, where: if the updated file and update event passes all tests of the sequence of tests (122), marking the file as being integrous, and alternatively, transmitting an alert signal indicating a malware risk related to the updated file (1) or update event.

Dependencies are inferred from the claim text.