Using feature vector windows to infer and mitigate ransomware activity

A computer program product comprising:

• one or more computer-readable storage media;
• and
• program instructions stored on the one or more storage media to perform operations comprising:
• adding an incoming first feature vector to an outer window;
• in response to a determination that the first feature vector is a qualifying feature vector, adding the first feature vector into a voting window;
• in response to a determination that the outer window is full, removing a relatively oldest feature vector from the outer window;
• and
• using feature vectors in the voting window to infer ransomware activity.

A computer system comprising:

• a processor set;
• one or more computer-readable storage media;
• and
• program instructions stored on the one or more storage media to cause the processor set to perform operations comprising:
• adding an incoming first feature vector to an outer window;
• in response to a determination that the first feature vector is a qualifying feature vector, adding the first feature vector into a voting window;
• in response to a determination that the outer window is full, removing a relatively oldest feature vector from the outer window;
• and
• using feature vectors in the voting window to infer ransomware activity.