Systems and methods for detection and mitigation of malicious encryption
AssigneeOpen Text Corporation
InventorDaniel Vernon Bailey
Life of this patent
Estimating the term…
Abstract
The present disclosure describes systems and methods for detection and mitigation of malicious encryption. A security agent on an infected computing device may monitor data writes to disk, memory, or network transmission buffers for strings that may represent encryption keys or moduli. The security agent may apply one or more techniques to decode and parse the string to either identify or extract the keys, or rule out the string as containing an encryption key or modulus. If a key is identified, or its presence cannot be excluded, then the security agent may generate an alert and take mitigation actions.
Claims20
A method for detecting and mitigating malicious encryption, comprising:
- detecting, by a security agent executed by a computing device, an encryption key in a first item of data based on the application of one or more tests to the first item of data, wherein the detecting includes:
- attempting to decode, by the security agent, the first item of data and analyzing the decoded data for the presence of predetermined strings or formats associated with an encryption key, and
- if the presence of the predetermined strings or formats is not detected, detecting an encryption key the first item of data based on the application of one or more secondary tests to the first item of data;
- and
- responsive to detecting an encryption key in the first item of data:
- generating an alert, by the security agent, indicating a likely malicious encryption attempt, and
- taking, by the security agent, one or more actions to mitigate the malicious encryption attempt.
A system for detecting and mitigating malicious encryption, comprising:
- a memory unit of a computing device, the memory unit storing a first item of data;
- and
- a security agent, executed by a processor of a computing device, configured to detect a write operation for the first item of data to the memory unit, and responsive to the detection:
- detecting an encryption key in the first item of data based on the application of one or more tests to the first item of data, wherein the detecting includes:
- attempting to decode the first item of data and analyzing the decoded data for the presence of predetermined strings or formats associated with an encryption key, and
- if the presence of the predetermined strings or formats is not detected, detecting an encryption key the first item of data based on the application of one or more secondary tests to the first item of data;
- and
- responsive to detecting an encryption key in the first item of data:
- generating an alert indicating a likely malicious encryption attempt, and
- taking one or more actions to mitigate the malicious encryption attempt.
A method for mitigating malicious encryption, comprising:
- detecting, by a security agent executed by a computing device, a likely malicious encryption attempt on the computing device;
- and
- responsive to detecting the likely malicious encryption attempt on the computing device, taking, by the security agent, one or more actions to mitigate the malicious encryption attempt, wherein the one or more actions include:
- generating an alert indicating the likely malicious encryption attempt,
- preventing write commands to memory of the computing device,
- creating one or more backups of data on the computing device, and
- searching the one or more backups for an encryption key.
Dependencies are inferred from the claim text.