Just-in-time filesystem-based ransomware backup

Patent metadata

Field	Value
Publication number	US-12373299-B2
Application number	US-202318159394-A
Country	US
Kind code	B2
Filing date	Jan 25, 2023
Priority date	Jan 25, 2023
Publication date	Jul 29, 2025
Grant date	Jul 29, 2025

Abstract

One example method includes detecting a file access process, such as a write operation performed by a ransomware process, directed to a file, based on the detecting, incrementing a counter, checking to determine if the counter exceeds a defined threshold, and when the counter exceeds the defined threshold, creating a backup of the file. The backup file may be a read-only file, and may expire, and be deleted, at a particular time, or after the passage of a period of time.

First claim

What is claimed is:

1. A method, comprising:
detecting a file access process directed to a file;
in a case where the file access process is detected, checking a name of the file to determine whether the file is a backup file;
in a case where it is determined that the file is the backup file, shutting down the file access process; and
in a case where it is determined that the file is not the backup file:
based on the detecting, incrementing a counter each time the file access process is detected;
checking to determine if the counter exceeds a defined threshold; and
when the counter exceeds the defined threshold, creating a backup of the file,

wherein, in a case where the file is determined to be the backup file, an administrator is notified of the file access, or a machine where the file access is occurring is shut down.

2. The method as recited in claim 1 , wherein the file access process comprises a write operation.

3. The method as recited in claim 1 , wherein a possible ransomware attack is indicated by the counter exceeding the defined threshold.

4. The method as recited in claim 1 , wherein the file is only backed up when the counter exceeds the defined threshold.

5. The method as recited in claim 1 , wherein the backup automatically expires, and is deleted, at a particular time, or after a particular period of time has passed.

6. The method as recited in claim 1 , wherein the defined threshold comprises a rate at which the file access process and one or more additional file access processes, collectively, are performed.

7. The method as recited in claim 1 , wherein the backup is used to overwrite the file when part of the file is encrypted by a ransomware process.

8. The method as recited in claim 1 , wherein when part of the file is encrypted by a ransomware process, the file is restored using the backup.

9. The method as recited in claim 1 , wherein the file access process corresponds to a process ID in a map, and the counter comprises the process ID.

10. A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
detecting a file access process directed to a file;
in a case where the file access process is detected, checking a name of the file to determine whether the file is a backup file;
in a case where it is determined that the file is the backup file, shutting down the file access process; and
in a case where it is determined that the file is not the backup file:
based on the detecting, incrementing a counter each time the file access process is detected;
checking to determine if the counter exceeds a defined threshold; and
when the counter exceeds the defined threshold, creating a backup of the file,

wherein, in a case where the file is determined to be the backup file, an administrator is notified of the one file access, or a machine where the one file access is occurring is shut down.

11. The non-transitory storage medium as recited in claim 10 , wherein the file access process comprises a write operation.

12. The non-transitory storage medium as recited in claim 10 , wherein a possible ransomware attack is indicated by the counter exceeding the defined threshold.

13. The non-transitory storage medium as recited in claim 10 , wherein the file is only backed up when the counter exceeds the defined threshold.

14. The non-transitory storage medium as recited in claim 10 , wherein the backup automatically expires, and is deleted, at a particular time, or after a particular period of time has passed.

15. The non-transitory storage medium as recited in claim 10 , wherein after the backup of the file is created, both the file and the backup of the file are monitored for file access processes.

16. The non-transitory storage medium as recited in claim 10 , wherein the backup is used to overwrite the file when part of the file is encrypted by a ransomware process.

17. The non-transitory storage medium as recited in claim 10 , wherein when part of the file is encrypted by a ransomware process, the file is restored using the backup.

18. The non-transitory storage medium as recited in claim 10 , wherein the file access process corresponds to a process ID in a map, and the counter comprises the process ID.

Assignees

• Dell Products Lp

Inventors

• Rothschild Seth Jacob
• Shafik Farida

Classifications

• G06F11/1458

  Management of the backup or restore process · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F11/1451 Primary

  by selection of backup contents · CPC title

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title