Devices, systems, and methods for ransomware protection and mitigation
AssigneesOceanit Laboratories, Inc., The Regents of the University of Michigan
InventorsDavid Siu, J. Alex Halderman, Max Froehlich, Steven Sprecher, Ky Ho, Wen Plotnick
Life of this patent
Estimating the term…
Abstract
Disclosed herein are devices, systems, and methods for detecting, mitigating, and protecting against malicious actions and/or malicious computer software, including malware and ransomware. Specifically, disclosed embodiments mitigate the threat of ransomware across a wide range of devices including, for example, servers, storage systems, computers, and portable storage devices.
Claims25
A non-transitory computer-readable storage medium, having instructions stored thereon that, when executed by a computing device, cause the computing device to perform operations, the operations comprising:
- logging requests to write data to a storage device of the computing device to a data journal;
- determining when a malicious attack has occurred on the computing device;
- and
- when it has been determined that the malicious attack has occurred, restoring original data to the storage device from the data journal,
- wherein the instructions stored on the non-transitory computer-readable storage medium operate below the level of an operating system of the computing device.
A system comprising:
- a computing device comprising a storage device and a non-transitory computer-readable storage medium having instructions stored thereon that, when executed by the computing device, cause the computing device to perform operations, the operations comprising detecting and mitigating malicious activity on the computing device;
- a command-and-control server that coordinates status tracking of the storage device and recovery of the computing device;
- a firmware manager that permits the computing device to communicate with the command-and-control server and issue data restoration commands to the non-transitory computer-readable storage medium to restore data in the storage device;
- and
- a management panel to provide a user interface to functionality of the command-and-control server including monitoring status of the storage device and initiating recovery of the computing device after occurrence of the malicious activity.
Dependencies are inferred from the claim text.