Advanced file modification heuristics

Patent metadata

Field	Value
Publication number	US-2025068731-A1
Application number	US-202418944668-A
Country	US
Kind code	A1
Filing date	Nov 12, 2024
Priority date	Jun 29, 2017
Publication date	Feb 27, 2025
Grant date	—

Abstract

Examples of the present disclosure describe systems and methods for providing advanced file modification heuristics. In aspects, software content is selected for monitoring. The monitoring comprises determining when the software content performs file accesses that are followed by read and/or write operations. The read/write operations are analyzed in real-time to determine whether the software content is modifying file content. If the monitoring indicates the software content is modifying accessed files, mathematical calculations are applied to the read-write operations to determine the nature of the modifications. Based on the determined nature of the file modifications, the actions of the software content may be categorized and halted prior to completion; thereby, mitigating malicious cyberattacks and/or unauthorized accesses.

First claim

What is claimed is:

1 . A system comprising:
a processor; and a non-transitory computer readable media storing instructions that are executable by the processor for: obtaining monitoring results of monitoring selected software content, the monitoring results indicating that the selected software content performs accesses of data content, including input/output (I/O) operations on the data content; analyzing the I/O operations to determine whether the I/O operations are modifying the data content, wherein the analyzing of the actions of the I/O operations does not perform evaluations on the data content on which the I/O operations are performed; responsive to a determination that the actions of the I/O operations are modifying the data content, categorizing the actions of the I/O operations; and responsive to the determined categorization, determining a response to the actions of the I/O operations.

2 . The system of claim 1 , wherein the I/O operations are analyzed using a file modification heuristic.

3 . The system of claim 2 , wherein the file modification heuristic includes one or more of an I/O block analysis, a cumulative read/write analysis, an I/O offset comparison, or an I/O sequence analysis.

4 . The system of claim 1 , wherein categorizing the action of the I/O operations comprises determining a nature of the modification of the data content.

5 . The system of claim 4 , wherein determining the nature of the modification comprises applying Shannon Entropy to the I/O operations, applying Pearson's chi-squared test to the I/O operations or applying a Monte Carlo method to the I/O operations.

6 . The system of claim 1 , wherein determining a response comprises comparing the categorization to a list of known malicious or non-malicious software content, or evaluating the categorization using a set of rules or a model.

7 . The system of claim 6 , wherein the response comprises pausing or terminating the I/O operations, restricting access by the software content to at least a portion of the data content, or suppressing functionality available to the software content.

8 . A method, comprising:
obtaining monitoring results of monitoring selected software content, the monitoring results indicating that the selected software content performs accesses of data content, including input/output (I/O) operations on the data content; analyzing the I/O operations to determine whether the I/O operations are modifying the data content, wherein the analyzing of the actions of the I/O operations does not perform evaluations on the data content on which the I/O operations are performed; responsive to a determination that the actions of the I/O operations are modifying the data content, categorizing the actions of the I/O operations; and responsive to the determined categorization, determining a response to the actions of the I/O operations.

9 . The method of claim 8 , wherein the I/O operations are analyzed using a file modification heuristic.

10 . The method of claim 9 , wherein the file modification heuristic includes one or more of an I/O block analysis, a cumulative read/write analysis, an I/O offset comparison, or an I/O sequence analysis.

11 . The method of claim 8 , wherein categorizing the action of the I/O operations comprises determining a nature of the modification of the data content.

12 . The method of claim 11 , wherein determining the nature of the modification comprises applying Shannon Entropy to the I/O operations, applying Pearson's chi-squared test to the I/O operations or applying a Monte Carlo method to the I/O operations.

13 . The method of claim 8 , wherein determining a response comprises comparing the categorization to a list of known malicious or non-malicious software content, or evaluating the categorization using a set of rules or a model.

14 . The method of claim 13 , wherein the response comprises pausing or terminating the I/O operations, restricting access by the software content to at least a portion of the data content, or suppressing functionality available to the software content.

15 . A non-transitory computer readable medium, comprising instructions for:
obtaining monitoring results of monitoring selected software content, the monitoring results indicating that the selected software content performs accesses of data content, including input/output (I/O) operations on the data content; analyzing the I/O operations to determine whether the I/O operations are modifying the data content, wherein the analyzing of the actions of the I/O operations does not perform evaluations on the data content on which the I/O operations are performed; responsive to a determination that the actions of the I/O operations are modifying the data content, categorizing the actions of the I/O operations; and responsive to the determined categorization, determining a response to the actions of the I/O operations.

16 . The method of claim 15 , wherein the I/O operations are analyzed using a file modification heuristic.

17 . The method of claim 16 , wherein the file modification heuristic includes one or more of an I/O block analysis, a cumulative read/write analysis, an I/O offset comparison, or an I/O sequence analysis.

18 . The method of claim 15 , wherein categorizing the action of the I/O operations comprises determining a nature of the modification of the data content.

19 . The method of claim 18 , wherein determining the nature of the modification comprises applying Shannon Entropy to the I/O operations, applying Pearson's chi-squared test to the I/O operations or applying a Monte Carlo method to the I/O operations.

20 . The method of claim 15 , wherein determining a response comprises comparing the categorization to a list of known malicious or non-malicious software content, or evaluating the categorization using a set of rules or a model.

21 . The method of claim 20 , wherein the response comprises pausing or terminating the I/O operations, restricting access by the software content to at least a portion of the data content, or suppressing functionality available to the software content.

Assignees

• Open Text Inc

Inventors

• Klonowski Eric
• Chetlur Sesha Salendra

Classifications

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title