Systems and methods for preventive ransomware detection using file honeypots

Patent metadata

Field	Value
Publication number	US-10938854-B2
Application number	US-201816132639-A
Country	US
Kind code	B2
Filing date	Sep 17, 2018
Priority date	Sep 22, 2017
Publication date	Mar 2, 2021
Grant date	Mar 2, 2021

Abstract

A system and method is provided for detecting ransomware and malicious programs. An exemplary method comprises generating, by a hardware processor, a file honeypot in a directory in a filesystem, wherein the file honeypot is included on a file list of contents of the directory, receiving a directory enumeration request from a process executing in an operating system environment, determining whether the process is identified in a list of trusted processes based on one or more of a certificate, fingerprint, name, and process identifier, when the process is not found in the list of trusted processes, providing, by the filesystem, the file list including the file honeypot to the process responsive to receiving the directory enumeration request and otherwise, providing the file list excluding the file honeypot to the process, intercepting, by a filesystem filter driver, a file modification request for the file honeypot from the process when the file honeypot is included in the file list and identifying the process as a suspicious object responsive to intercepting the file modification request from the process.

First claim

What is claimed is:

1. A method for detecting ransomware and malicious programs, the method comprising:
generating, by a hardware processor, a file honeypot in a directory in a filesystem, wherein the file honeypot is included on a file list of contents of the directory;
receiving a directory enumeration request from a process executing in an operating system environment;
determining whether the process is identified in a list of trusted processes based on one or more of a certificate, fingerprint, name, and process identifier;
when the process is not found in the list of trusted processes, providing, by the filesystem, the file list including the file honeypot to the process responsive to receiving the directory enumeration request and otherwise, providing the file list excluding the file honeypot to the process;
intercepting, by a filesystem filter driver, a file modification request for the file honeypot from the process when the file honeypot is included in the file list; and
identifying the process as a suspicious object responsive to intercepting the file modification request from the process.

2. The method of claim 1 , wherein generating the file honeypot further comprises at least one of:
creating a special file corresponding to the file honeypot in the directory, and updating the file list to add a filename of the special file at a first position of the file list.

3. The method of claim 1 , wherein generating the file honeypot further comprises:
adding a filename of a nonexistent file to the file list associated with the directory.

4. The method of claim 1 , further comprising:
assigning to the generated file honeypot a filename having at least one steganographic element.

5. The method of claim 1 , further comprising:
modifying a file attribute of the generated file honeypot to indicate a hidden file.

6. The method of claim 1 , wherein generating the file honeypot further comprises:
generating the file honeypot according to a template that specifies a document type and one or more file naming rules comprising at least one steganographic element.

7. The method of claim 1 , further comprising:
responsive to receiving the directory enumeration request, performing a machine learning analysis on a stack trace of the directory enumeration request using machine learning; and
adding a file honey pot to the provided file list responsive to the directory enumeration request based on the machine learning analysis.

8. A system for detecting ransomware and malicious programs, the system comprising:
a storage device having a filesystem; and
a hardware processor configured to:
generate a file honeypot in a directory in the filesystem, wherein the file honeypot is included on a file list of contents of the directory;
receive a directory enumeration request from a process executing in an operating system environment;
determine whether the process is identified in a list of trusted processes based on one or more of a certificate, fingerprint, name, and process identifier;
when the process is not found in the list of trusted processes, provide, by the filesystem, the file list including the file honeypot to the process responsive to receiving the directory enumeration request and otherwise, providing the file list excluding the file honeypot to the process;
intercept, by a filesystem filter driver, a file modification request for the file honeypot from the process when the file honeypot is included in the file list; and
identify the process as a suspicious object responsive to intercepting the file modification request from the process.

9. The system of claim 8 , wherein the processor configured to generate the file honeypot is further configured to:
create a special file corresponding to the file honeypot in the directory, and updating the file list to add a filename of the special file at a first position of the file list.

10. The system of claim 8 , wherein the processor configured to generate the file honeypot is further configured to:
add a filename of a nonexistent file to the file list associated with the directory.

11. The system of claim 8 , wherein the processor is further configured to:
assign to the generated file honeypot a filename having at least one steganographic element.

12. The system of claim 8 , wherein the processor is further configured to:
modify a file attribute of the generated file honeypot to indicate a hidden file.

13. The system of claim 8 , wherein the processor configured to generate the file honeypot is further configured to:
generate the file honeypot according to a template that specifies a document type and one or more file naming rules comprising at least one steganographic element.

14. The system of claim 8 , wherein the processor is further configured to:
responsive to receiving the directory enumeration request, perform a machine learning analysis on a stack trace of the directory enumeration request using machine learning; and
add a file honey pot to the provided file list responsive to the directory enumeration request based on the machine learning analysis.

15. A non-transitory computer readable medium comprising computer executable instructions for protecting a computer system from ransomware and malicious programs, including instructions for:
generating a file honeypot in a directory in a filesystem, wherein the file honeypot is included on a file list of contents of the directory;
receiving a directory enumeration request from a process executing in an operating system environment;
determining whether the process is identified in a list of trusted processes based on one or more of a certificate, fingerprint, name, and process identifier;
when the process is not found in the list of trusted processes, providing, by the filesystem, the file list including the file honeypot to the process responsive to receiving the directory enumeration request and otherwise, providing the file list excluding the file honeypot to the process;
intercepting, by a filesystem filter driver, a file modification request for the file honeypot from the process when the file honeypot is included in the file list; and
identifying the process as a suspicious object responsive to intercepting the file modification request from the process.

16. The non-transitory computer readable medium of claim 15 , wherein the instructions for generating the file honeypot further comprises instructions for:
creating a special file corresponding to the file honeypot in the directory, and updating the file list to add a filename of the special file at a first position of the file list.

17. The non-transitory computer readable medium of claim 15 , wherein the instructions for generating the file honeypot further comprises instructions for:
adding a filename of a nonexistent file to the file list associated with the directory.

18. The non-transitory computer readable medium of claim 15 , further comprising instructions for:
assigning to the generated file honeypot a filename having at least one steganographic element.

19. The non-transitory computer readable medium of claim 15 , further comprising instructions for:
modifying a file attribute of the generated file honeypot to indicate a hidden file.

20. The non-transitory computer readable medium of claim 15 , wherein the instructions for generating the file honeypot further comprises instructions for
generating the file honeypot according to a template that specifies a document type and one or more file naming rul

Assignees

• Acronis Int Gmbh

Inventors

• Strogov Vladimir
• Dod Alexey
• Kostyushko Alexey
• Chernyakovsky Valeriy
• Beloussov Serguei
• Ulasen Sergey
• Protasov Stanislav

Classifications

• G06N20/00

  Machine learning · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06F21/554

  involving event detection and direct action · CPC title