Systems and methods for protecting files from malicious encryption attempts
AssigneeSymantec Corporation
InventorUri Mann
Life of this patent
Estimating the term…
Abstract
A computer-implemented method for protecting files from malicious encryption attempts may include (1) detecting an attempt to alter a file, (2) identifying at least one characteristic of the attempt to alter the file, (3) determining, based on the characteristic of the attempt to alter the file, that the attempt to alter the file represents a malicious attempt by a third party to encrypt the file, and (4) performing a security action in response to determining that the attempt to alter the file represents a malicious attempt by the third party to encrypt the file. Various other methods, systems, and computer-readable media are also disclosed.
Claims20
A computer-implemented method for protecting computer files from malicious ransomware attempts, the method comprising:
- detecting, using a filter that monitors activity on a computing device having at least one processor, an attempt to alter a file stored on the computing device;
- identifying a characteristic of the attempt to alter the file;
- determining, based on the characteristic of the attempt to alter the file, that the attempt to alter the file comprises a malicious attempt by a third party, which is not a legitimate owner of the file, to alter the file in a manner that would prevent the legitimate owner of the file from accessing the file;
- and
- performing, in response to determining that the attempt to alter the file comprises the malicious attempt by the third party to alter the file in a manner that would prevent the legitimate owner of the file from accessing the file, a security action to protect the file from the malicious attempt.
A system for protecting files from malicious encryption attempts, the system comprising:
- a detection module, stored in memory on a computing device, that detects, using a filter that monitors activity on the computing device, an attempt to alter a file stored on the computing device;
- an identification module, stored in memory, that identifies a characteristic of the attempt to alter the file;
- a determination module, stored in memory, that determines, based on the characteristic of the attempt to alter the file, that the attempt to alter the file comprises a malicious attempt by a third party, which is not a legitimate owner of the file, to alter the file in a manner that would prevent the legitimate owner of the file from accessing the file;
- a security module, stored in memory, that performs, in response to determining that the attempt to alter the file comprises the malicious attempt by the third party to alter the file in a manner that would prevent the legitimate owner of the file from accessing the file, a security action to protect the file from the malicious attempt;
- and
- at least one physical processor configured to execute the detection module, the identification module, the determination module, and the security module.
A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
- detect, using a filter that monitors activity on the computing device, an attempt to alter a file stored on the computing device;
- identify a characteristic of the attempt to alter the file;
- determine, based on the characteristic of the attempt to alter the file, that the attempt to alter the file comprises a malicious attempt by a third party, which is not a legitimate owner of the file, to alter the file in a manner that would prevent the legitimate owner of the file from accessing the file;
- and
- perform, in response to determining that the attempt to alter the file comprises the malicious attempt by the third party to alter the file in a manner that would prevent the legitimate owner of the file from accessing the file, a security action to protect the file from the malicious attempt.
Dependencies are inferred from the claim text.