Ransomware resetter

Patent metadata

Field	Value
Publication number	US-10839072-B2
Application number	US-201815876284-A
Country	US
Kind code	B2
Filing date	Jan 22, 2018
Priority date	Jan 22, 2018
Publication date	Nov 17, 2020
Grant date	Nov 17, 2020

Abstract

A method and a related system for a protection against unauthorized file encryption in a file system may be provided. The method may comprise providing an anti-ransomware file access unit, determining, by the anti-ransomware file access unit, an entropy value for a portion of a file to be written to the file system, and upon determining that the entropy value is equal or above a threshold value, performing a copy-on-write process to the file to be written, whereby the file is written to a copy-on-write storage area.

First claim

What is claimed is:

1. A method for a protection against unauthorized file encryption in a file system, comprising:
continuously monitoring operations of an executable file;
in response to detecting a process id associated with an executable file, calculating a hash value of the executable file;
searching a copy-on-write directory for an entry including the calculated hash value;
based on locating a corresponding entry in the copy-on-write directory, intercepting input and output system calls from the executable file;
based on an operation being a request to write a file, determining an entropy value for a portion of the file to be written;
upon determining that the entropy value is equal to or a above a threshold value,
performing a copy-on-write process to the file to be written, wherein a copy-on-write entry is created in the copy-on-write directory for the executable file not having a corresponding entry, and wherein the copy-on-write entry includes the process id associated with the executable file, a program name, the calculated hash, and a file system path to the executable file, otherwise writing the file to a host file system; and
based on the operation being a request to read the file, returning to the operation a file handle from either a copy-on-write storage area or from the host file system, depending on a location of the file.

2. The method according to claim 1 , wherein the threshold is a predefined threshold value.

3. The method according to claim 1 , further comprising:
upon determining that the entropy value is below the threshold value, performing a write operation of the file in the file system, wherein the original file is modified.

4. The method according to claim 1 , further comprising:
copying files from the copy-on-write storage area to the file system.

5. The method according to claim 1 , wherein the copy-on-write storage area is outside of, and separate from, the file system.

6. The method according to claim 1 , wherein the entropy value is determined by:
compressing data comprised in the file;
comparing a compression value of the file or parts thereof; and
deriving the entropy value from the compression value.

7. The method according to claim 1 , further comprising reading a file by: searching an index of the copy-on-write storage area for the entry matching the file, and, based on the match of the file in the index, reading the file from the copy-on-write storage area, otherwise, reading the file from the file system.

8. The method according to claim 1 , further comprising:
providing a separate anti-ransomware file access unit for every process accessing the file system.

9. A system for a protection against unauthorized file encryption in a file system, comprising a memory, one or more processors, one or more tangible computer-readable storage devices, an anti-ransomware file access unit, and a plurality of program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors to perform the method comprising:
continuously monitoring operations of an executable file;
in response to detecting a process id associated with an executable file, calculating a hash value of the executable file;
searching a copy-on-write directory for an entry including the calculated hash value;
based on locating a corresponding entry in the copy-on-write directory, intercepting input and output system calls from the executable file;
based on an operation being a request to write a file, determining an entropy value for a portion of the file to be written;
upon determining that the entropy value is equal to or a above a threshold value,
performing a copy-on-write process to the file to be written, wherein a copy-on-write entry is created in the copy-on-write directory for the executable file not having a corresponding entry, and wherein the copy-on-write entry includes the process id associated with the executable file, a program name, the calculated hash, and a file system path to the executable file, otherwise writing the file to a host file system; and
based on the operation being a request to read the file, returning to the operation a file handle from either a copy-on-write storage area or from the host file system, depending on a location of the file.

10. The system according to claim 9 , wherein based on determining, that the entropy value is below the threshold value, performing a write operation of the file in the file system, wherein the original file is modified.

11. The system according to claim 9 , wherein a message is generated if the copy-on-write process is performed, and wherein the message indicates a security breach.

12. The system according to claim 9 , further comprising:
copying files from the copy-on-write storage area to the file system in response to determining that the files in the copy-on-write storage area is not infected.

13. The system according to claim 9 , wherein the copy-on-write storage area is outside of, and separate from, the file system.

14. The system according to claim 9 , wherein the anti-ransomware file access unit determines the entropy value by:
compressing data comprised in the file;
comparing a compression value of the file or parts thereof; and
deriving the entropy value from the compression value.

15. The system according to claim 9 , further comprising:
searching an index of the copy-on-write storage area for the entry matching the file, and based on locating the file in the index, reading the file from the copy-on-write storage area, otherwise, reading the file from the file system.

16. The system according to claim 9 , further comprising:
a separate anti-ransomware file access unit for every process accessing the files system.

17. A computer program product for a protection against unauthorized file encryption in a file system, the computer program product comprising a non-transitory computer readable storage device having program instructions embodied therewith, the program instructions being executable by one or more computing systems to cause the one or more computing systems to:
continuously monitoring operations of an executable file;
in response to detecting a process id associated with an executable file, calculating a hash value of the executable file;
searching a copy-on-write directory for an entry including the calculated hash value;
based on locating a corresponding entry in the copy-on-write directory, intercepting input and output system calls from the executable file;
based on an operation being a request to write a file, determining an entropy value for a portion of the file to be written;
upon determining that the entropy value is equal to or a above a threshold value,
performing a copy-on-write process to the file to be written, wherein a copy-on-write entry is created in the copy-on-write directory for the executable file not having a corresponding entry, and wherein the copy-on-write entry includes the process id associated with the executable file, a program name, the calculated hash, and a file system path to the executable file, otherwise writing the file to a host file system; and
based on the operation being a request to read the file, returning to the operation a file handle from either a copy-on-write storage area or from the host file system, depending on a location of the file.

Assignees

• IBM

Inventors

• Pohl Thomas
• Tröster Martin
• Kroll Marco H
• Seul Matthias

Classifications

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• G06F16/152

  using file content signatures, e.g. hash values · CPC title

• G06F21/79

  in semiconductor storage media, e.g. directly-addressable memories · CPC title

• G06F11/1451

  by selection of backup contents · CPC title

• G06F3/0619

  in relation to data integrity, e.g. data losses, bit errors · CPC title