Advanced file modification heuristics

Patent metadata

Field	Value
Publication number	US-12174952-B2
Application number	US-202318170421-A
Country	US
Kind code	B2
Filing date	Feb 16, 2023
Priority date	Jun 29, 2017
Publication date	Dec 24, 2024
Grant date	Dec 24, 2024

Abstract

Examples of the present disclosure describe systems and methods for providing advanced file modification heuristics. In aspects, software content is selected for monitoring. The monitoring comprises determining when the software content performs file accesses that are followed by read and/or write operations. The read/write operations are analyzed in real-time to determine whether the software content is modifying file content. If the monitoring indicates the software content is modifying accessed files, mathematical calculations are applied to the read-write operations to determine the nature of the modifications. Based on the determined nature of the file modifications, the actions of the software content may be categorized and halted prior to completion; thereby, mitigating malicious cyberattacks and/or unauthorized accesses.

First claim

What is claimed is:

1. A system comprising:
a processor; and
a non-transitory computer readable media storing instructions that are executable by the processor for:
obtaining monitoring results of monitoring of selected software content, the monitoring results indicating that the selected software content performs accesses of data content followed by input/output (I/O) operations on the data content;
analyzing, in real time, actions of the I/O operations to determine whether the actions of the I/O operations are modifying the data content, wherein the analyzing of the actions excludes any evaluation of the data content on which the I/O operations are performed;
responsive to determining that the actions of the I/O operations are modifying the data content, determining a categorization of the actions of the I/O operations; and
responsive to determining the categorization, determining in real time whether to halt the actions of the I/O operations prior to completion.

2. The system of claim 1 , wherein the instructions are executable by the processor for:
selecting the selected software content for monitoring.

3. The system of claim 1 , wherein the monitoring of the selected software content includes monitoring an event file.

4. The system of claim 1 , wherein the accesses of data content comprise an access of a file, wherein the I/O operations on the data content comprise I/O operations on the accessed file.

5. The system of claim 1 , wherein determining the categorization of the actions of the I/O operations comprises determining whether the actions of the I/O operations comprise data compression or data encryption.

6. The system of claim 1 , wherein the instructions are executable by the processor for:
restoring a previous version of the data content.

7. The system of claim 1 , wherein determining the categorization of the actions of the I/O operations comprises evaluating randomness in accessed data content.

8. A method, comprising:
obtaining monitoring results of monitoring of selected software content, the monitoring results indicating that the selected software content performs accesses of data content followed by input/output (I/O) operations on the data content;
analyzing, in real time, actions of the I/O operations to determine whether the actions of the I/O operations are modifying the data content, wherein the analyzing of the actions excludes any evaluation of the data content on which the I/O operations are performed;
responsive to determining that the actions of the I/O operations are modifying the data content, determining a categorization of the actions of the I/O operations; and
responsive to determining the categorization, determining in real time whether to halt the actions of the I/O operations prior to completion.

9. The method of claim 8 , further comprising:
selecting the selected software content for monitoring.

10. The method of claim 8 , wherein the monitoring of the selected software content includes monitoring an event file.

11. The method of claim 8 , wherein the accesses of data content comprise an access of a file, wherein the I/O operations on the data content comprise I/O operations on the accessed file.

12. The method of claim 8 , wherein determining the categorization of the actions of the I/O operations comprises determining whether the actions of the I/O operations comprise data compression or data encryption.

13. The method of claim 8 , further comprising:
restoring a previous version of the data content.

14. The method of claim 8 , wherein determining the categorization of the actions of the I/O operations comprises evaluating randomness in accessed data content.

15. A non-transitory computer readable medium, comprising instructions for:
obtaining monitoring results of monitoring of selected software content, the monitoring results indicating that the selected software content performs accesses of data content followed by input/output (I/O) operations on the data content;
analyzing, in real time, actions of the I/O operations to determine whether the actions of the I/O operations are modifying the data content, wherein the analyzing of the actions excludes any evaluation of the data content on which the I/O operations are performed;
responsive to determining that the actions of the I/O operations are modifying the data content, determining a categorization of the actions of the I/O operations; and
responsive to determining the categorization, determining in real time whether to halt the actions of the I/O operations prior to completion.

16. The non-transitory computer readable medium of claim 15 , wherein the instructions are for:
selecting the selected software content for monitoring.

17. The non-transitory computer readable medium of claim 15 , wherein the monitoring of the selected software content includes monitoring an event file.

18. The non-transitory computer readable medium of claim 15 , wherein the accesses of data content comprise an access of a file, wherein the I/O operations on the data content comprise I/O operations on the accessed file.

19. The non-transitory computer readable medium of claim 15 , wherein determining the categorization of the actions of the I/O operations comprises determining whether the actions of the I/O operations comprise data compression or data encryption.

20. The non-transitory computer readable medium of claim 15 , wherein the instructions are for:
restoring a previous version of the data content.

21. The non-transitory computer readable medium of claim 15 , wherein determining the categorization of the actions of the I/O operations comprises evaluating randomness in accessed data content.

Assignees

• Webroot Inc

Inventors

• Klonowski Eric
• Chetlur Sesha Sailendra

Classifications

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title