Back to results
US 9,734,337 B1Granted
Behavior-based ransomware detection
AssigneeMalwarebytes Inc.
InventorsMark William Patton, Ares Lopez Ituiño
Life of this patent
Estimating the term…
Abstract
An anti-malware application detects, stops, and quarantines ransomware. The anti-malware application monitors threads executing on a computing device and detects behaviors that conform to a predefined set of behaviors indicative of ransomware. Responsive to detecting these behaviors, indicators are stored to a log in a storage device. Each of the indicators in the log is associated with respective scores. A running score for each thread is generated by combining the respective scores of the indicators in the log. Responsive to determining that the running score exceeds a predefined threshold score, execution of the thread is terminated. The source ransomware file is then identified and quarantined.
Claims18
A method for detecting and removing malware, the method comprising:
- monitoring a target thread executing on a computing device;
- storing to a log in a storage device, a parent reference to a parent thread that launched the target thread or injected code into the target thread;
- detecting, by a processor, a behavior of the target thread that conforms to one of a predefined set of behaviors indicative of ransomware;
- responsive to detecting the behavior, storing a new indicator associated with the detected behavior to the log, the log storing a plurality of past indicators for respective previously detected behaviors of the target thread, and the log storing respective scores for the new indicator and the plurality of past indicators;
- generating a running score for the target thread by combining the respective scores of the plurality of past indicators and the new indicator associated with the target thread in the log;
- determining that the running score for the target thread exceeds a predefined threshold score;
- responsive to determining that the running score exceeds the predefined threshold score, terminating execution of the target thread;
- identifying the parent thread based on the parent reference in the log and terminating execution of the parent thread;
- identifying based on a source file reference stored in the log in association with the parent thread, a source malware file that launched the parent thread;
- and
- responsive to identifying the source malware file that launched the parent thread, quarantining the source malware file.
8 more elements
A non-transitory computer-readable storage medium storing instructions for detecting and removing malware, the instructions when executed by a processor cause the processor to perform steps including:
- monitoring a target thread executing on a computing device;
- storing to a log in a storage device, a parent reference to a parent thread that launched the target thread or injected code into the target thread;
- detecting a behavior of the target thread that conforms to one of a predefined set of behaviors indicative of ransomware;
- responsive to detecting the behavior, storing a new indicator associated with the detected behavior to the log, the log storing a plurality of past indicators for respective previously detected behaviors of the target thread, and the log storing respective scores for the new indicator and the plurality of past indicators;
- generating a running score for the target thread by combining the respective scores of the plurality of past indicators and the new indicator associated with the target thread in the log;
- determining that the running score for the target thread exceeds a predefined threshold score;
- responsive to determining that the running score exceeds the predefined threshold score, terminating execution of the target thread;
- identifying the parent thread based on the parent reference in the log and terminating execution of the parent thread;
- identifying based on a source file reference stored in the log in association with the parent thread, a source malware file that launched the parent thread;
- and
- responsive to identifying the source malware file that launched the parent thread, quarantining the source malware file.
8 more elements
A computing system comprising:
- a processor;
- and
- a non-transitory computer-readable storage medium storing instructions for detecting and removing malware, the instructions when executed by the processor cause the processor to perform steps including:
- monitoring a target thread executing on a computing device;
- storing to a log in a storage device, a parent reference to a parent thread that launched the target thread or injected code into the target thread;
- detecting a behavior of the target thread that conforms to one of a predefined set of behaviors indicative of ransomware;
- responsive to detecting the behavior, storing a new indicator associated with the detected behavior to the log, the log storing a plurality of past indicators for respective previously detected behaviors of the target thread, and the log storing respective scores for the new indicator and the plurality of past indicators;
- generating a running score for the target thread by combining the respective scores of the plurality of past indicators and the new indicator associated with the target thread in the log;
- determining that the running score for the target thread exceeds a predefined threshold score;
- responsive to determining that the running score exceeds the predefined threshold score, terminating execution of the target thread;
- identifying the parent thread based on the parent reference in the log and terminating execution of the parent thread;
- identifying based on a source file reference stored in the log in association with the parent thread, a source malware file that launched the parent thread;
- and
- responsive to identifying the source malware file that launched the parent thread, quarantining the source malware file.
11 more elements
Dependencies are inferred from the claim text.