Ransomware infection detection in filesystems

Abstract

Described herein is a system that detects ransomware infection in filesystems. The system detects ransomware infection by using backup data of machines. The system detects ransomware infection in two stages. In the first stage, the system analyzes a filesystem's behavior. The filesystem's behavior can be obtained by loading the backup data and crawling the filesystem to create a filesystem metadata including information about file operations during a time interval. The filesystem determines a pattern of the file operations and compares the pattern to a normal patter to analyze the filesystem's behavior. If the filesystem's behavior is abnormal, the system proceeds to the second stage to analyze the content of the files to look for signs of encryption in the filesystem. The system combines the analysis of both stages to determine whether the filesystem is infected by ransomware.

1 . A method, comprising:
 determining, based at least in part on a first set of backup data corresponding to a machine, a first pattern of changes to at least one file in a filesystem of the machine that occurred during a first time interval;   determining, using a ransomware detection model operative to detect an infection of the filesystem by ransomware, a second pattern of changes in the filesystem that occurred during a second time interval that is shorter than the first time interval and subsequent to the first time interval, the second pattern of changes determined based at least in part on a second set of backup data corresponding to the machine, wherein the ransomware detection model uses at least one model feature that is based at least in part on the first set of backup data;   calculating, using the ransomware detection model, a set of abnormal scores indicating respective probabilities that the filesystem behaves abnormally based at least in part on a comparison of the second pattern of changes to the first pattern of changes;   detecting, using the ransomware detection model, abnormal behavior of the filesystem based at least in part on a combination of abnormal scores from the set of abnormal scores; and   presenting, within a user interface, an indication that the filesystem is infected based at least in part on the ransomware detection model detecting the abnormal behavior.   
     
     
         2 . The method of  claim 1 , wherein the machine is a virtual machine. 
     
     
         3 . The method of  claim 2 , wherein the first and second sets of backup data are snapshots of the virtual machine. 
     
     
         4 . The method of  claim 1 , further comprising:
 training the at least one model feature using training data, the training data including at least one of filesystem data of filesystems owned by multiple users, filesystem data of filesystems owned by a user, and filesystem data of a filesystem owned by the user.   
     
     
         5 . The method of  claim 1 , further comprising:
 training the at least one model feature using training data, the training data including filesystem data of the machine.   
     
     
         6 . The method of  claim 1 , further comprising:
 recording the first pattern of changes in the filesystem, the second pattern of changes in the filesystem, or both, in filesystem metadata.   
     
     
         7 . The method of  claim 1 , wherein calculating the set of abnormal scores comprises:
 calculating a respective abnormal score of the set of abnormal scores using a respective machine learning model of a set of machine learning models, wherein each machine learning model of the set of machine learning models is configured to calculate an abnormal score of the set of abnormal scores.   
     
     
         8 . The method of  claim 7 , wherein detecting the abnormal behavior comprises:
 generating the combined abnormal score by combining the abnormal scores calculated by the set of machine learning models; and   determining that the combined abnormal score satisfies a threshold abnormal score.   
     
     
         9 . The method of  claim 1 , wherein the first pattern of changes is a normal pattern of changes based on features representing a behavior of the filesystem. 
     
     
         10 . The method of  claim 1 , further comprising:
 determining, using the ransomware detection model, whether files in the filesystem are encrypted by extracting entropy features from the at least one file, wherein the extracted entropy features measure randomness of the at least one file, and wherein the ransomware detection model uses at least one second model feature that is based at least in part on entropies associated with the first set of backup data;   calculating, using the ransomware detection model, an encryption score representing a likelihood of the at least one file being encrypted based at least in part on the extracted entropy features; and   determining, using the ransomware detection model, that the filesystem is infected based at least in part on detecting the abnormal behavior and the encryption score.   
     
     
         11 . The method of  claim 1 , further comprising:
 assessing, using the ransomware detection model, respective entropies of the at least one file responsive to the detection of the abnormal behavior; and   determining that the filesystem is infected based at least in part on detecting the abnormal behavior and the assessment of the respective entropies.   
     
     
         12 . A non-transitory computer-readable medium storing code, the code comprising instructions executable by at least one processor to:
 determine, based at least in part on a first set of backup data corresponding to a machine, a first pattern of changes to at least one file in a filesystem of the machine that occurred during a first time interval;   determine, using a ransomware detection model operative to detect an infection of the filesystem by ransomware, a second pattern of changes in the filesystem that occurred during a second time interval that is shorter than the first time interval and subsequent to the first time interval, the second pattern of changes determined based at least in part on a second set of backup data corresponding to the machine, wherein the ransomware detection model uses at least one model feature that is based at least in part on the first set of backup data;   calculate, using the ransomware detection model, a set of abnormal scores indicating respective probabilities that the filesystem behaves abnormally based at least in part on a comparison of the second pattern of changes to the first pattern of changes;   detect, using the ransomware detection model, abnormal behavior of the filesystem based at least in part on a combination of abnormal scores from the set of abnormal scores; and   present, within a user interface, an indication that the filesystem is infected based at least in part on the ransomware detection model detecting the abnormal behavior.   
     
     
         13 . The non-transitory computer-readable medium of  claim 12 , wherein the machine is a virtual machine. 
     
     
         14 . The non-transitory computer-readable medium of  claim 13 , wherein the first and second sets of backup data are snapshots of the virtual machine. 
     
     
         15 . The non-transitory computer-readable medium of  claim 12 , wherein the instructions are further executable by the at least one processor to:
 train the at least one model feature using training data, the training data including at least one of filesystem data of filesystems owned by multiple users, filesystem data of filesystems owned by a user, and filesystem data of a filesystem owned by the user.   
     
     
         16 . The non-transitory computer-readable medium of  claim 12 , wherein the instructions are further executable by the at least one processor to:
 train the at least one model feature using training data, the training data including filesystem data of the machine.   
     
     
         17 . The non-transitory computer-readable medium of  claim 12 , wherein the instructions are further executable by the at least one processor to:
 record the first pattern of changes in the filesystem, the second pattern of changes in the filesystem, or both, in filesystem metadata.   
     
     
         18 . The non-transitory computer-readable medium of  claim 12 , wherein, to calculate the set of abnormal scores, the instructions are executable by the at least one processor to:
 calculate a respective abnormal score of the set of abnormal scores using a respective machine learning model of a set of machine learning models, wherein each machine learning model of the set of machine learning models is configured to calculate an abnormal score of the set of abnormal scores.   
     
     
         19 . The non-transitory computer-readable medium of  claim 12 , wherein the first pattern of changes is a normal pattern of changes based on features representing a behavior of the filesystem. 
     
     
         20 . An apparatus for data management, comprising:
 at least one processor;   memory coupled with the at least one processor; and   instructions stored in the memory and executable by the at least one processor to cause the apparatus to:
 determine, based at least in part on a first set of backup data corresponding to a machine, a first pattern of changes to at least one file in a filesystem of the machine that occurred during a first time interval; 
 determine, using a ransomware detection model operative to detect an infection of the filesystem by ransomware, a second pattern of changes in the filesystem that occurred during a second time interval that is shorter than the first time interval and subsequent to the first time interval, the second pattern of changes determined based at least in part on a second set of backup data corresponding to the machine, wherein the ransomware detection model uses at least one model feature that is based at least in part on the first set of backup data; 
 calculate, using the ransomware detection model, a set of abnormal scores indicating respective probabilities that the filesystem behaves abnormally based at least in part on a comparison of the second pattern of changes to the first pattern of changes; 
 detect, using the ransomware detection model, abnormal behavior of the filesystem based at least in part on a combination of abnormal scores from the set of abnormal scores; and 
 present, within a user interface, an indication that the filesystem is infected based at least in part on the ransomware detection model detecting the abnormal behavior.