US 2026/0278098 A1 · SYSTEMS AND METHODS OF REDUCING AN IMPACT OF FALSE-POSITIVE DETECTIONS IN A KERNEL

Abstract

A computer-implemented method for mitigating effects of false positive detections of ransomware includes monitoring one or more characteristics of a computing device within a first network, detecting a ransomware event based on the one or more characteristics, and, in response to detecting the ransomware event identifying, using a kernel on the computing device, at least one process on the computing device associated with the ransomware event, halting the at least one identified process on the computing device, determining whether halting the at least one identified process stopped detection of the ransomware event on the computing device, and, based on whether halting the at least one identified process stopped detection of the ransomware event, at least one of performing additional analysis to identify a cause of the ransomware event and performing one or more mitigating actions on the computing device.

Claims20

Dependent claims

A computer-implemented method for mitigating effects of false positive detections of ransomware, comprising:

monitoring one or more characteristics of a computing device within a first network;
detecting a ransomware event based on the one or more characteristics;
and
in response to detecting the ransomware event
identifying, using a kernel on the computing device, at least one process on the computing device associated with the ransomware event,
halting the at least one identified process on the computing device,
determining whether halting the at least one identified process stopped detection of the ransomware event on the computing device, and
based on whether halting the at least one identified process stopped detection of the ransomware event, at least one of (i) performing additional analysis to identify a cause of the ransomware event and (ii) performing one or more mitigating actions on the computing device.

5 more elements

A system for mitigating effects of false positive detections of ransomware, the system comprising:

memory storing instructions;
and
a processor configured to execute the instructions, wherein executing the instructions causes the processor to:
monitor one or more characteristics of a computing device within a first network;
detect a ransomware event based on the one or more characteristics;
and
in response to detecting the ransomware event
identify, using a kernel on the computing device, at least one process on the computing device associated with the ransomware event,
halt the at least one identified process on the computing device,
determine whether halting the at least one identified process stopped detection of the ransomware event on the computing device, and
based on whether halting the at least one identified process stopped detection of the ransomware event, at least one of (i) perform additional analysis to identify a cause of the ransomware event and (ii) perform one or more mitigating actions on the computing device.

8 more elements

Dependencies are inferred from the claim text.

Systems and methods of reducing an impact of false-positive detections in a kernel

Life of this patent

Systems and methods of reducing an impact of false-positive detections in a kernel

Life of this patent

Abstract

Claims20