Back to results
US 9,807,115 B2Granted
System and a method for identifying the presence of malware and ransomware using mini-traps set at network endpoints
AssigneeTopspin Security Ltd
InventorsDoron Kolton, Rami Mizrahi, Omer Zohar, Benny Ben-Rabi, Alex Barbalat, Shlomi Gabai
Life of this patent
Estimating the term…
Abstract
A system and a method for identifying the presence of ransomware on a network including a plurality of resources, and for trapping the ransomware therein.
Claims14
A system for identifying the presence of malware on a network, comprising:
- a plurality of resources, interconnected to form a network;
- at least one decoy drive forming part of said decoy network, at least one of said at least one decoy drive comprising a virtual decoy drive;
- at least one mini-trap installed on at least one of said plurality of resources and functionally associated with at one of said at least one decoy drive, said at least one mini-trap comprising deceptive information directing ransomware accessing said at least one mini-trap to said decoy drive associated therewith;
- and
- a manager node forming part of said network and configured to manage placement of said at least one mini-trap on said at least one of said plurality of resources and association between said at least one mini-trap and said decoy drive associated therewith,
- wherein said decoy drive includes a plurality of decoy files to be encrypted by said ransomware, and wherein said decoy drive continuously provides said decoy files thereby continuously occupying said ransomware.
3 more elements
A method for identifying the presence of ransomware on a network including a plurality of resources, the method comprising:
- providing at least one decoy drive including a plurality of decoy files, said at least one decoy drive forming part of said network, at least one of said at least one decoy drive comprising a virtual decoy drive;
- installing at least one mini-trap on at least one of said plurality of resources, said at least one mini-trap comprising deceptive information directing ransomware accessing said at least one mini-trap to a specific one of said at least one decoy drive associated therewith;
- detecting said ransomware encrypting decoy files in said at least one decoy drive, thereby to identify the presence of said ransomware on said at least one of said plurality of resources where said at least one mini-trap is installed;
- and
- following said detecting said ransomware encrypting said decoy files, continuously providing additional decoy files to said ransomware for encryption, thereby continuously occupying said ransomware.
2 more elements
A system for identifying the presence of malware on a network, comprising:
- a plurality of resources, interconnected to form a network;
- at least one decoy drive mounted onto at least one of said plurality of resources, said at least one decoy drive forming part of a decoy network, at least one of said at least one decoy drive comprising a virtual decoy drive;
- and
- a manager node forming part of said network and configured to manage placement of said at least one mini-trap on said at least one of said plurality of resources and association between said at least one mini-trap and said decoy drive associated therewith,
- wherein, when ransomware accesses said at least one decoy drive and encrypts at least one decoy file thereon, said decoy drive continuously provides to said ransomware additional decoy files for encryption, thereby continuously occupying said ransomware.
2 more elements
Dependencies are inferred from the claim text.