Method and system for mitigating the effects of ransomware

Patent metadata

Field	Value
Publication number	US-9888032-B2
Application number	US-201615144847-A
Country	US
Kind code	B2
Filing date	May 3, 2016
Priority date	May 3, 2016
Publication date	Feb 6, 2018
Grant date	Feb 6, 2018

Abstract

Computerized methods and systems mitigate the effect of a ransomware attack on an endpoint by detecting access events associated with requests by processes, including ransomware processes, to access data items on the endpoint. The data items are hidden from the operating system processes executed on the endpoint. In response to detecting an access event, an action is taken against the process associated with the access event.

First claim

What is claimed is:

1. A method for mitigating the effect of a ransomware attack on an endpoint, comprising:
deploying a plurality of data items in a plurality of file directories on the endpoint, each of the deployed data items being hidden from operating system processes executed on the endpoint and including data for baiting a ransomware process to request access to the deployed data items, the deploying based on a protection priority level assigned to the file directories and user files in the file directories, the protection priority level derived from the quantity and frequency of historical accesses, by a user of the endpoint, to the file directories and user files in the file directories, such that, the number of data items deployed in each respective file directory increases with respect to the protection priority level assigned to the respective file directory and the files in the respective file directory;
detecting at least one access event associated with a request by a process to access at least one of the deployed data items on the endpoint; and
responding to the detecting of the at least one access event by taking at least one action against the process associated with the detected access event.

2. The method of claim 1 , wherein the process is a ransomware process.

3. The method of claim 1 , wherein each of the deployed data items includes a file.

4. The method of claim 3 , further comprising:
modifying at least one property of each of the deployed files such that, the first file in each respective file directory accessed by a ransomware process during the ransomware attack is one of the deployed of files.

5. The method of claim 4 , wherein the modifying the at least one property includes modifying the file extensions of at least a subset of the deployed files, such that at least one of the deployed files in a respective file directory has a different file extension from at least one other of the deployed files in the respective file directory.

6. The method of claim 4 , wherein the modifying the at least one property includes modifying the file name each of the deployed files.

7. The method of claim 4 , wherein the modifying the at least one property includes modifying at least one of: the file creation time of at least a subset of the deployed files, the file modification time of at least a subset of the deployed files, or a combination thereof.

8. The method of claim 1 , wherein the at least one action is selected from the group consisting of: slowing down the process, preventing the process from accessing data items in addition to the at least one of the deployed data items, suspending the process, creating a backup copy of at least a subset of data items sharing a common directory with the at least one of the deployed data items, preventing the deletion of at least a subset of data items sharing a common directory with the at least one of the deployed data items, and a combination thereof.

9. The method of claim 1 , further comprising:
analyzing the process by performing at least one heuristic to determine whether the process is a ransomware process.

10. The method of claim 9 , wherein the at least one heuristic is selected from the group consisting of: detecting the process by the signatures of the process, analyzing the permissions requested by the process, determining whether at least one component of the at least one data item is encrypted, analyzing the entropy of the at least one of the deployed data items subsequent to the process writing to the at least one of the deployed data items, analyzing the process to predict the behavior of the process, and a combination thereof.

11. The method of claim 9 , wherein the at least one action includes creating a backup copy of at least a subset of data items sharing a common directory path with the at least one of the deployed data items, and deleting the backup copy if the process is determined not to be a ransomware process.

12. The method of claim 9 , further comprising:
causing the taking of a protective action if the process is determined to be a ransomware process.

13. The method of claim 1 , wherein each of the deployed data items is deployed such that, each deployed data item is the first data item in the respective file directory for which the ransomware process requests access.

14. The method of claim 1 , wherein the protection priority level is further based in part on a priority assigned by a user of the endpoint.

15. The method of claim 1 , wherein the protection priority level assigned to the respective file directory and the files in the respective file directory increases with respect to the quantity and frequency of the historical accesses.

16. A computer system for mitigating the effect of a ransomware attack on an endpoint, comprising:
a non-transitory computer readable storage medium for storing computer components; and
a hardware processor for executing the computer components comprising:
a computer module configured for:
deploying a plurality of data items in a plurality of file directories on the endpoint, each of the deployed data items being hidden from operating system processes executed on the endpoint and including data for baiting a ransomware process to request access to the deployed data items, the deploying based on a protection priority level assigned to the file directories and user files in the file directories, the protection priority level derived from the quantity and frequency of historical accesses, by a user of the endpoint, to the file directories and user files in the file directories, such that, the number of data items deployed in each respective file directory increases with respect to the protection priority level assigned to the respective file directory and the files in the respective file directory;
detecting at least one access event associated with a request by a process to access at least one of the deployed data items on the endpoint; and
responding to the detecting of the at least one access event by taking at least one action against the process associated with the detected access event.

17. The computer system of claim 16 , wherein each of the deployed data items includes a file, and the computer module is further configured for:
modifying at least one property of each of the deployed files such that, the first file in each respective file directory accessed by a ransomware process during the ransomware attack is one of the deployed of files.

18. The computer system of claim 16 , wherein the computer module includes a file system filter driver.

19. A computer usable non-transitory storage medium having a computer program embodied thereon for causing a suitable programmed system to mitigate the effect of a ransomware attack on an endpoint, by performing the following steps when such program is executed on the system, the steps comprising:
deploying a plurality of data items in a plurality of file directories on the endpoint, each of the deployed data items being hidden from operating system processes executed on the endpoint and including data for baiting a ransomware process to request access to the deployed data items, the deploying based on a protection priority level assigned to the file directories and user files in the file directories, the protection priority level derived from the quantity and frequency of historical accesses, by a user of the endpoint, to the file directories and user files in the file directories, such that, the number of data items deployed in each respective file directory increas

Assignees

• Check Point Software Tech Ltd

Inventors

• Dekel Kasif
• Mizrachi Liad
• Zaikin Roman
• Vanunu Oded

Classifications

• G06F21/60

  Protecting data · CPC title

• H04L63/145 Primary

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04W12/128

  Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware · CPC title

• G06F2221/2127

  Bluffing · CPC title

• G06F21/554

  involving event detection and direct action · CPC title