Instruction Monitoring For Dynamic Cloud Workload Reallocation Based On Ransomware Attacks
AssigneeOracle International Corporation
InventorPhani Bhushan Avadhanam
Life of this patent
Estimating the term…
Abstract
The present embodiments relate to identifying a ransomware attack. One embodiment relates to a method comprising configuring an operating system to collect metrics related to a hardware component. A message can be received from a user space library to validate an instruction detected in a cache, the instruction being associated with the hardware component. A metric can be compared to a threshold metric. The metric can be associated with the hardware component. A likelihood of a ransomware attack can be determined based at least in part on the comparison. A message can be transmitted to the user space library comprising the determination of the likelihood of the ransomware.
Claims20
A method comprising:
- reading instructions from a plurality of memory rows of an instruction cache;
- determining whether the instructions are associated with encryption;
- in response to determining that at least one of the instructions relates to encryption, executing a verification operation over a time window, the verification operation comprising:
- for individual pairs of adjacent memory rows of the plurality of memory rows:
- generating a difference value indicative of dissimilarity between encryption instructions identified in a first memory row of an individual pair of adjacent memory rows and encryption instructions identified in a second memory row of the individual pair of adjacent memory rows;
- determining a combined difference value by aggregating the difference values for the individual pairs of adjacent memory rows;
- and
- determining that the combined difference value exceeds a threshold value indicative of sustained encryption activity over the time window;
- determining, based on the verification operation, that a ransomware attack is present;
- and
- generating an indication of the ransomware attack.
One or more non-transitory computer-readable media storing program instructions that, when executed by one or more hardware processors, cause performance of operations comprising:
- reading instructions from a plurality of memory rows of an instruction cache;
- determining whether the instructions are associated with encryption;
- in response to determining that at least one of the instructions relates to encryption, executing a verification operation over a time window, the verification operation comprising:
- for individual pairs of adjacent memory rows of the plurality of memory rows:
- generating a difference value indicative of dissimilarity between encryption instructions identified in a first memory row of an individual pair of adjacent memory rows and encryption instructions identified in a second memory row of the individual pair of adjacent memory rows;
- determining a combined difference value by aggregating the difference values for the individual pairs of adjacent memory rows;
- and
- determining that the combined difference value exceeds a threshold value indicative of sustained encryption activity over the time window;
- determining, based on the verification operation, that a ransomware attack is present;
- and
- generating an indication of the ransomware attack.
A system comprising:
- one or more hardware processors;
- one or more non-transitory computer-readable media;
- and
- program instructions stored on the one or more non-transitory computer-readable media that, when executed by the one or more hardware processors, cause the system to perform operations comprising:
- reading instructions from a plurality of memory rows of an instruction cache;
- determining whether the instructions are associated with encryption;
- in response to determining that at least one of the instructions relates to encryption, executing a verification operation over a time window, the verification operation comprising:
- for individual pairs of adjacent memory rows of the plurality of memory rows:
- generating a difference value indicative of dissimilarity between encryption instructions identified in a first memory row of an individual pair of adjacent memory rows and encryption instructions identified in a second memory row of the individual pair of adjacent memory rows;
- determining a combined difference value by aggregating the difference values for the individual pairs of adjacent memory rows;
- and
- determining that the combined difference value exceeds a threshold value indicative of sustained encryption activity over the time window;
- determining, based on the verification operation, that a ransomware attack is present;
- and
- generating an indication of the ransomware attack.
Dependencies are inferred from the claim text.