Ransomware detection and mitigation

Abstract

A processing system including at least one processor may detect an accessing of a file, where the accessing comprises a read operation, generate a copy of the file in response to detecting the accessing of the file, and store the copy of the file in a designated storage location. The processing system may further detect a completion of the accessing of the file, apply a checksum operation to the file to generate a checksum in response to detecting the completion of the accessing of the file, determine that the checksum does not match an expected checksum for the file, and generate an alert of a possible manipulation of the file in response to determining that the checksum does not match the expected checksum.

What is claimed is: 
     
         1 . A method, comprising:
 receiving, by a processing system including at least one processor and implementing a protection application, a first user designation of a plurality of files to be protected by the protection application;   detecting, by the processing system, a read operation of a file during an initial accessing of the file, wherein the read operation comprises a read of less than an entirety of the file;   responsive to the detecting the read operation of the file, determining, by the processing system, whether there is an indication of a ransomware attack by identifying whether the file is included in the plurality of files;   generating, by the processing system, a reference copy of the file in response to a determination that there is the indication of the ransomware attack based on identifying that the file is included in the plurality of files, wherein the generating the reference copy of the file comprises generating a copy of only a read portion of the file and not a remainder of the file;   storing, by the processing system and in response to the indication of the ransomware attack, the reference copy of the file in a designated storage location for future recovery of the reference copy by the protection application;   detecting, by the processing system, that the file is no longer being accessed;   applying, by the processing system, a checksum operation to the file to generate a checksum in response to the detecting that the file is no longer being accessed;   determining, by the processing system, that the checksum does not match an expected checksum for the file and thereby that the indication of the ransomware attack comprises an actual ransomware attack; and   generating, by the processing system, an alert of the actual ransomware attack in response to the determining that the checksum does not match the expected checksum.   
     
     
         2 . The method of  claim 1 , wherein the alert indicates an encryption of the file by a ransomware process, wherein the protection application further functions as an independent operating system on a protected computing system that comprises at least one drive or drive partition, and wherein the protection application is configured to interface with one or more hardware components of the protected computing system and is active upon rebooting of the protected computing system to prevent the protected computing system from being rebooted and the at least one drive or drive partition from being locked by encryptor-type ransomware. 
     
     
         3 . The method of  claim 1 , further comprising:
 applying a bit-level or a byte-level comparison of the file and the reference copy of the file to generate a correlation metric between the file and the reference copy of the file, wherein the applying the bit-level or byte-level comparison is performed in response to the determining that the checksum does not match the expected checksum.   
     
     
         4 . The method of  claim 3 , further comprising:
 determining that the actual ransomware attack comprises an encryption of the file by a ransomware process, when the correlation metric is less than a threshold level of correlation, wherein the alert indicates the encryption of the file by the ransomware process.   
     
     
         5 . The method of  claim 3 , further comprising:
 determining that a manipulation of the file comprises a modification of the file by an application, a process, or a user that exceeds a permission level of the application, the process, or the user, when the correlation metric is greater than a threshold level of correlation.   
     
     
         6 . The method of  claim 1 , wherein at least the detecting the read operation, the detecting that the file is no longer being accessed, and the generating the reference copy of the file are performed by the processing system using a kernel level component that interfaces between running processes and a file system containing the file. 
     
     
         7 . The method of  claim 1 , wherein the alert presents a plurality of response options to address the actual ransomware attack, the method further comprising:
 obtaining a selection of one of the plurality of response options; and   implementing the one of the plurality of response options.   
     
     
         8 . The method of  claim 7 , wherein one of the plurality of response options comprises an overwriting of the file. 
     
     
         9 . The method of  claim 1 , wherein the generating the reference copy of the file in response to the determination, the storing the reference copy of the file in the designated storage location, the detecting that the file is no longer being accessed, and the applying the checksum operation to generate the checksum comprise a verification process to detect a manipulation of the file, and wherein the method further comprises:
 detecting an additional accessing of the file by a trusted application, a trusted process, or a trusted user, wherein the processing system omits performance of the verification process for the additional accessing of the file by the trusted application, the trusted process, or the trusted user.   
     
     
         10 . The method of  claim 1 , further comprising:
 applying, by the processing system, the checksum operation to the reference copy of the file to generate the expected checksum.   
     
     
         11 . The method of  claim 1 , wherein the initial accessing of the file is from a protected computing system. 
     
     
         12 . The method of  claim 11 , wherein the processing system comprises at least a portion of the protected computing system, and wherein the protected computing system comprises:
 a single computing device; or   a plurality of computing devices.   
     
     
         13 . The method of  claim 11 , wherein the protected computing system comprises a virtual machine that is hosted by one or more host computing devices. 
     
     
         14 . The method of  claim 11 , wherein the protected computing system comprises a distributed data storage system comprising a plurality of host storage devices. 
     
     
         15 . The method of  claim 11 , wherein the designated storage location is selected by an administrator of the protected computing system, and wherein the designated storage location comprises at least one of:
 a data storage component of the protected computing system; or   an external data storage device.   
     
     
         16 . The method of  claim 11 , wherein the designated storage location comprises a distributed data storage system provided via a plurality of host data storage devices. 
     
     
         17 . A non-transitory computer-readable medium storing instructions which, when executed by a processing system including at least one processor, cause the processing system to perform operations including implementing a protection application, the operations comprising:
 receiving a first user designation of a plurality of files to be protected by the protection application;   detecting a read operation of a file during an initial accessing of the file, wherein the read operation comprises a read of less than an entirety of the file;   responsive to the detecting the read operation of the file, determining whether there is an indication of a ransomware attack by identifying whether the file is included in the plurality of files;   generating a reference copy of the file in response to a determination that there is the indication of the ransomware attack based on identifying that the file is included in the plurality of files, wherein the generating the reference copy of the file comprises generating a copy of only a read portion of the file and not a remainder of the file;   storing, in response to the indication of the ransomware attack, the reference copy of the file in a designated storage location for future recovery of the reference copy by the protection application;   identifying that the read operation has ended;   applying a checksum operation to the file to generate a checksum in response to the identifying that the read operation has ended;   determining that the checksum does not match an expected checksum for the file and thereby that the indication of the ransomware attack comprises an actual ransomware attack; and   generating an alert of the actual ransomware attack in response to the determining that the checksum does not match the expected checksum.   
     
     
         18 . The non-transitory computer-readable medium of  claim 17 , wherein the protection application functions as an independent operating system on a protected computing system that comprises at least one drive or drive partition, and wherein the protection application is configured to interface with one or more hardware components of the protected computing system and is active upon rebooting of the protected computing system to prevent the protected computing system from being rebooted and the at least one drive or drive partition from being locked by encryptor-type ransomware. 
     
     
         19 . An apparatus comprising:
 a processing system including at least one processor; and   a computer-readable medium storing instructions which, when executed by the processing system, cause the processing system to perform operations including implementing a protection application, the operations comprising:   receiving a first user designation of a plurality of files to be protected by the protection application;   detecting a read operation of a file during an initial accessing of the file, wherein the read operation comprises a read of less than an entirety of the file;   responsive to the detecting the read operation of the file, determining whether there is an indication of a ransomware attack by identifying whether the file is included in the plurality of files;   generating a reference copy of the file in response to a determination that there is the indication of the ransomware attack based on identifying that the file is included in the plurality of files, wherein the generating the reference copy of the file comprises generating a copy of only a read portion of the file and not a remainder of the file;   storing, in response to the indication of the ransomware attack, the reference copy of the file in a designated storage location to facilitate future recovery of the reference copy by the protection application;   detecting that the file is no longer being accessed;   applying a checksum operation to the file to generate a checksum in response to the detecting that the file is no longer being accessed;   determining that the checksum does not match an expected checksum for the file and thereby that the indication of the ransomware attack comprises an actual ransomware attack; and   generating an alert of the actual ransomware attack in response to the determining that the checksum does not match the expected checksum, wherein the generating the reference copy of the file enables protection against the actual ransomware attack.   
     
     
         20 . The apparatus of  claim 19 , wherein the protection application functions as an independent operating system on a protected computing system that comprises at least one drive or drive partition, and wherein the protection application is configured to interface with one or more hardware components of the protected computing system and is active upon rebooting of the protected computing system to prevent the protected computing system from being rebooted and the at least one drive or drive partition from being locked by encryptor-type ransomware.