Method and system for coordinating service ransomware detection with client ransomware detection

Abstract

The cloud storage server receives a detection notification from a client device. The cloud storage server is configured to store files received from the client device. The detection notification indicates ransomware activity detected by the client device. The cloud storage server receives a remediation notification from the client device. The remediation notification indicates that the client device has remediated the ransomware activity. The cloud storage server updates an operation of a server-based ransomware detection application based on the detection notification and the remediation notification.

Description

Technical Field

[0001] In general, the subject matter disclosed herein relates to a special purpose machine that detects files affected by ransomware on client devices and cloud storage systems and improves coordination between client devices and cloud storage systems in detecting files affected by ransomware, including computerized variants of such special purpose machines and improvements to such variants, and techniques for improving such special purpose machines over other special purpose machines for detecting ransomware. In particular, the present disclosure relates to systems and methods for coordinating detection of files affected by ransomware between client devices and cloud storage systems and updating client devices and cloud storage systems based on the coordinated detection. Background Art

[0002] In regular cases, ransomware attacks a computer by modifying some files stored on the computer by encrypting the contents of the files and holding the encrypted files for ransom. The computer user may have no other way to restore the encrypted files except to pay the ransom. If the ransom is not paid within the specified time, the files will be lost permanently. BRIEF DESCRIPTION OF THE DRAWINGS

[0003] In the figures of the accompanying drawings, some embodiments are shown by way of example and not limitation.

[0004] Figure 1 is a block diagram illustrating an example environment for detecting files affected by ransomware, according to an exemplary embodiment.

[0005] Figure 2 is a block diagram illustrating components within a storage system according to an exemplary embodiment.

[0006] Figure 3 is a block diagram illustrating components within a malware analysis engine, according to an exemplary embodiment.

[0007] Figure 4 is a block diagram illustrating a method of interaction between components of a client device and a storage system according to an exemplary embodiment.

[0008] Figure 5 is a block diagram illustrating a method of interaction between components of a client device and a storage system according to another exemplary embodiment.

[0009] Figure 6 is a flow chart of a method for coordinating ransomware detection at a storage system according to an exemplary embodiment.

[0010] Figure 7 is a flow chart of a method for coordinating ransomware detection at a storage system according to another exemplary embodiment.

[0011] Figure 8 is a flow chart of a method for coordinating ransomware detection at a client device, according to an exemplary embodiment.

[0012] Fig. 9 is a flow chart of a method for detecting ransomware activity according to another exemplary embodiment.

[0013] Fig.10 is a flow chart of a method for determining ransomware activity in a storage system according to an exemplary embodiment.

[0014] Fig.11 is a schematic diagram representation of a machine in the example form of a computing system within which a set of instructions may be executed to cause the machine to perform any one or more of the methodologies discussed herein, according to an example embodiment. DETAILED DESCRIPTION

[0015] The following specific embodiments describe the system, method, technology, instruction sequence and computer program product for illustrating the exemplary embodiments of the subject of the present invention. In the following description, for the sake of ease of explanation, many specific details are set forth in order to provide an understanding of the various embodiments of the subject of the present invention. However, it is apparent to those of ordinary skill in the art that the embodiments of the subject of the present invention can be put into practice without some or other of these specific details. Examples represent possible variations only. Unless otherwise clearly stated, structures (e.g., structural components such as modules) are optional and can be combined or subdivided, and operations (e.g., operations in processes, algorithms or other functions) can be changed in order or combined or subdivided.

[0016] Example methods (e.g., algorithms) and systems (e.g., dedicated machines) detect and identify files stored in a cloud storage system or client device affected by ransomware, and coordinate notification and remediation in the cloud storage system and client device between a server-based ransomware detection application and a client-based ransomware detection application. Files stored in a cloud storage server may be synchronized to a drive or folder at a corresponding client device registered with the cloud storage server.

[0017] In an exemplary embodiment, a server-based ransomware detection application performs a series of tests on a single file (and heuristics for multiple files) in a cloud storage account of a client device. Examples of tests include: detecting whether a previously unencrypted file is now encrypted, detecting whether a file has been renamed using a file extension or naming pattern associated with ransomware, detecting whether the content of a file matches the content type identified by the file extension, and using machine learning based on user feedback to determine whether a file is affected by ransomware. Once the server-based ransomware detection application confirms that the file is affected by ransomware, the cloud storage server notifies the client-based ransomware detection application and shares information about the ransomware with the client-based ransomware detection application. The client-based ransomware detection application can suspend file synchronization operations between the client and the server until a remediation measure for the ransomware is received from the server-based ransomware detection application.

[0018] In another exemplary embodiment, a server-based ransomware detection application receives notification of files affected by ransomware at a client device from a client-based ransomware detection application. The client device notifies the server-based ransomware detection application and shares information about the ransomware with the server-based ransomware detection application. The server-based ransomware detection application may suspend operation of the server-based ransomware detection application until a remediation for the ransomware is received from the client-based ransomware detection application.

[0019] As a result, one or more of the methods described herein help to address the technical problem of lack of effective coordination and communication between a client-based ransomware detection application and a server-based ransomware detection application. In this way, one or more of the methods described herein can avoid the need for certain work or computing resources that would otherwise be used to generate duplicate notifications (e.g., one notification from a client device and another notification from a storage server) and duplicate remediation options (e.g., options from a client device, options from a storage server). As a result, resources used by one or more machines, databases, or devices (e.g., in an environment) can be reduced. Examples of such computing resources include processor cycles, network traffic, memory usage, data storage capacity, power consumption, network bandwidth, and cooling capacity.

[0020] Figure 1 1 is a block diagram illustrating an example environment 100 for detecting files affected by ransomware, according to an exemplary embodiment. In an exemplary embodiment, storage system 106 stores copies of files from client device 102. Figure 2 Storage system 106 is discussed in more detail.

[0021] Storage system 106 is coupled to one or more client devices (e.g., client device 102) via network 104. One or more portions of network 104 may be an ad hoc network, an intranet, an extranet, a virtual private network (VPN), a local area network (LAN), a wireless LAN (WLAN), a wide area network (WAN), a wireless WAN (WWAN), a metropolitan area network (MAN), a portion of the Internet, a portion of a public switched telephone network (PSTN), a cellular telephone network, a wireless network, a Wi-Fi network, a WiMax network, a satellite network, a wired network, a broadcast network, another type of network, or a combination of two or more such networks. Any one or more portions of network 104 may transmit information via a transmission or signal medium. As used herein, "transmission medium" refers to any intangible (e.g., transient) medium capable of transmitting (e.g., sending) instructions to be executed by a machine (e.g., executed by one or more processors of the machine), and includes digital or analog communication signals or other intangible media to facilitate communication of such software.

[0022] The client device 102 includes a client storage application 108, a client ransomware detection application 110, and a client ransomware coordination module 112. The client storage application 108 is configured to transfer files (e.g., send and receive files) or modifications in files to be stored at the storage system 106. For example, the client storage application 108 synchronizes local files stored in a preset directory or folder of the client device 102 with a corresponding directory or folder of the storage system 106. Thus, changes made to local files in the preset folder of the client device 102 are propagated to corresponding remote files (copies of local files) in the storage system 106. In one example, the client storage application 108 registers the client device 102 with the storage system 106 and transfers copies of local files selected by a user from the client device 102 to the storage system 106. In another example, changes made to remote files at the storage system 106 are propagated back to corresponding local files in the client device 102.

[0023] In an exemplary embodiment, the client ransomware detection application 110 detects whether files stored locally on the client device 102 are affected (or also referred to as infected) by ransomware (or malware). The client ransomware detection application 110 generates a notification to the client ransomware coordination module 112 and the client storage application 108. The client storage application 108, in response to the notification, suspends synchronization between the client storage application 108 and the storage system 106. The client ransomware coordination module 112 suspends ransomware notifications from the storage system 106 in response to detecting local files affected by ransomware at the client device 102. The client ransomware coordination module 112 shares the ransomware detection information with the storage system 106. Once the client ransomware detection application 110 remediates the local files affected by ransomware, the client ransomware coordination module 112 shares the remediation (e.g., deletes the affected files from the storage system or requests a previous version) and resumes ransomware notifications from the storage system 106.

[0024] In another exemplary embodiment, the client ransomware coordination module 112 receives a detection notification from the storage system 106 indicating a file affected by ransomware detected at the storage system 106. The client storage application 108, in response to the detection notification from the storage system 106, suspends synchronization between the client storage application 108 and the storage system 106. The storage system 106 shares information of the ransomware detection with the client ransomware detection application 110 via the client ransomware coordination module 112. Once the storage system 106 remediates the files affected by ransomware at the storage system 106, the storage system 106 shares the remediation with the client ransomware coordination module 112 (e.g., deleting the affected files from the storage system 106 or reverting to a previous version). The client ransomware detection application 110 resumes the generation of the ransomware notification by the client ransomware detection application 110.

[0025] Client devices 102 include, but are not limited to, smartphones, tablet computers, laptop computers, multiprocessor systems, microprocessor-based or programmable consumer electronics, game consoles, set-top boxes, or any other device used by a user to communicate over network 104. In an exemplary embodiment, client device 102 includes a display module (not shown) to display information (e.g., in the form of a specially configured user interface). In some embodiments, client device 102 may include one or more of a touch screen, a camera, a keyboard, a microphone, and a global positioning system (GPS) device.

[0026] Figure 1Any system or machine (e.g., database, device, server) shown or associated with the present invention may be, include, or otherwise be implemented in a special purpose (e.g., dedicated or other non-general purpose) computer that has been modified (e.g., configured or programmed by software such as one or more software modules of an application, operating system, firmware, middleware, or other program) to perform one or more of the functions described herein for the system or machine. For example, referring to Fig.11 A special purpose computer system capable of implementing any one or more of the methods described herein is discussed, and such a special purpose computer may therefore be a unit for performing any one or more of the methods discussed herein. In the art of such special purpose computers, a special purpose computer modified to perform the functions discussed herein by the structures discussed herein is a technical improvement over other special purpose computers that lack the structures discussed herein or are otherwise unable to perform the functions discussed herein. Therefore, a special purpose machine configured according to the systems and methods discussed herein improves upon the art of similar special purpose machines.

[0027] also, Figure 1 Any two or more of the systems or machines shown in the environment 100 may be combined into a single system or machine, and the functionality described herein for any single system or machine may be subdivided between multiple systems or machines. In addition, any number and type of client devices 102 may be implemented within the environment 100. Furthermore, certain components or functionality of the environment 100 may be combined or placed elsewhere in the environment 100. For example, certain functionality of the client storage application 108 may be embodied at the storage system 106.

[0028] Figure 2 is a block diagram illustrating components within a storage system, according to an exemplary embodiment. In an exemplary embodiment, the storage system 106 performs operations to detect and identify files stored in a cloud storage system (or a client device) that are affected by ransomware, and coordinates notification and remediation in the cloud storage system and the client device between a server-based ransomware detection application and a client-based ransomware detection application. To implement these operations, according to an exemplary embodiment, the storage system 106 includes a server-side ransomware coordination module 201, a server storage application 202, a data store 206, a ransomware analysis engine 210, a notification engine 214, and a communication module 216, all of which are configured to communicate with each other (e.g., via a bus, a shared memory, or a switch).

[0029] The server storage application 202 is configured to interface and communicate with the client storage application 108. The server storage application 202 receives copies of new or modified files from the client storage application 108. The server storage application 202 may also receive requests from the client storage application 108 to add a new file to the data store 206 or to replace an existing corresponding file with a modified file in the data store 206.

[0030] In other exemplary embodiments, the server storage application 202 receives and sends copies of files between the storage system 106 and the client device 102. In one example, the server storage application 202 is configured with the client storage application 108 to store one or more versions of the copies of files received from the client storage application 108. For example, the server storage application 202 registers with the client storage application 108 and forms a folder or directory at the storage system 106 (corresponding to the folder or directory selected by the user on the client device 102). Thus, any changes to the files in the folder at the client device 102 are replicated to the corresponding files in the corresponding folder at the storage system 106.

[0031] In another exemplary embodiment, the server storage application 202 identifies historical changes to a file stored on the storage system 106 based on different versions of the file received from the client storage application 108. The server storage application 202 stores the file change (e.g., a new file or a modified file) 204 in the data store 206 and optionally a malware detection time associated with the file.

[0032] The data store 206 is configured to store files (e.g., new files or modified files 204) received from the server storage application 202. These files may be copies of files stored at the client device 102. In one example, the data store 206 is configured to store multiple versions of files based on the date and time of the different versions of the files. These files may include attributes such as file name, file extension, and size. It will be appreciated by those of ordinary skill in the art that files may include other different types of attributes.

[0033] In an exemplary embodiment, the data store 206 is configured to store files and user information for individual users in user-specific data stores or databases (hereinafter collectively referred to as "user data structures"). For example, each user data structure may correspond to a folder and / or directory of the user's client device 102. Although the data store 206 is shown as part of the storage system 106, in some embodiments, the data store 206 may be located elsewhere in the environment 100 and communicatively coupled to the storage system 106. In addition, any number of data stores 206 may be used to store user data structures.

[0034] In an exemplary embodiment, data store 206 provides characteristics 208 of new or modified files (received from server storage application 202) to ransomware analysis engine 210. In another exemplary embodiment, data store 206 provides a stored copy of new or modified files 204 to ransomware analysis engine 210.

[0035] The ransomware analysis engine 210 performs a series of tests on the new or modified file 204 (or the file features 208 of the new or modified file 204) to detect whether the new or modified file 204 is affected by ransomware. Figure 3 The ransomware analysis engine 210 is discussed in more detail. Once the ransomware analysis engine 210 determines whether the new or modified file 204 is affected by ransomware, the ransomware analysis engine 210 provides an identification of the suspicious file 212 (eg, the new or modified file 204) to the notification engine 214.

[0036] The notification engine 214 generates a notification 215 requesting the user of the client storage application 108 to confirm and verify whether the suspicious file 212 is affected by ransomware. For example, the notification 215 includes an identification of the suspicious file 212, a time of suspected infection, a version of the suspicious file 212, an identification of who last modified the suspicious file 212, an identification of the name of the suspected ransomware (or malware), and an identification of the suspected change in the name or content of the suspicious file 212. The notification engine 214 provides the notification 215 to the communication module 216.

[0037] Notification engine 214 also provides a ransomware detection notification to server-side ransomware coordination module 201 to indicate that ransomware analysis engine 210 has detected a ransomware-affected file (e.g., suspicious file 212) stored in a data structure of data store 206 (associated with client device 102).

[0038] The server-side ransomware coordination module 201 shares ransomware information about files affected by the ransomware (e.g., names, characteristics, and properties of the ransomware and the files affected by the ransomware) with the client-side ransomware coordination module 112. The server-side ransomware coordination module 201 shares information about the detection event 203 (e.g., ransomware information) with the server storage application 202. The server storage application 202 retrieves the remediated file 205 from the data store 206 based on the detection event 203. The server storage application 202 also stops communicating with the client-side storage application 108 and stops synchronizing files with the data store 206 until the server-side ransomware coordination module 201 indicates that the suspicious file 212 has been remediated.

[0039] Client-side ransomware coordination module 112 receives a ransomware detection notification from server-side ransomware coordination module 201 and suspends synchronization between client-side storage application 108 and server storage application 202 until client-side ransomware coordination module 112 receives a remediation notification from server-side ransomware coordination module 201 .

[0040] In another exemplary embodiment, client-side ransomware detection application 110 detects local ransomware-affected files on client device 102 and generates a local ransomware detection notification to client-side ransomware coordination module 112. Client-side ransomware coordination module 112 shares ransomware information about local ransomware-affected files (e.g., names, characteristics, and properties of the ransomware and ransomware-affected files) with server-side ransomware coordination module 201.

[0041] The server-side ransomware coordination module 201 shares information about the local files affected by the ransomware (e.g., affected files 209) with the ransomware analysis engine 210 (so that the ransomware analysis engine 210 can learn from the shared information). The client storage application 108 retrieves the remediated files 205 from the data storage device 206. The server storage application 202 also stops communicating with the client storage application 108 and stops synchronizing files with the data storage 206 until the client-side ransomware coordination module 112 indicates that the local files affected by the ransomware have been remediated.

[0042] The communication module 216 is configured to exchange communications with the client device 102. For example, the communication module 216 sends a notification 215 to the client storage application 108. In response to sending the notification 215, the communication module 216 receives a ransomware confirmation 220 from the client storage application 108. The ransomware confirmation 220 indicates a confirmation by a user (of the client device 102) as to whether the suspicious file 212 is indeed affected by ransomware. The communication module 216 forwards the user feedback (e.g., the ransomware confirmation 220) to the ransomware analysis engine 210.

[0043] In other exemplary embodiments, the communication module 216 includes a user interface module (not shown) that is configured to cause a specially configured user interface to be presented on the client device 102 that includes a visual indication of files affected by the ransomware and other relevant information (e.g., infection time, last modified author, size change). The user interface module generates instructions and sends the instructions to the client device 102 to render and display the user interface.

[0044] Any one or more (e.g., modules, engines) of the components described herein may be implemented using separate hardware (e.g., one or more processors of a machine) or a combination of hardware and software. For example, any component described herein may physically include an arrangement of one or more processors, or a processor may be configured (e.g., among one or more processors of a machine) to perform the operations described herein on the module. Therefore, the different components described herein may include and configure different arrangements of processors at different points in time or a single arrangement of processors at different points in time. Each component (e.g., module) described herein is an example of a unit for performing the operations described herein on the component. Moreover, any two or more of these components may be combined into a single component, and the functions described herein for a single component may be subdivided among multiple components. In addition, according to various exemplary embodiments, the components described herein as being implemented in a single machine, database, or device may be distributed across multiple machines, databases, or devices. The storage system 106 may include other components that are not related to the exemplary embodiments not shown or discussed. Further, one or more components of the storage system 106 may be located in one or more of the client devices 102.

[0045] Figure 32 is a block diagram illustrating components within a ransomware analysis engine, according to an exemplary embodiment. The ransomware analysis engine 210 performs operations to detect and identify files affected by ransomware stored in the data store 206, and uses feedback validation from users of the data store 206 to improve the detection of ransomware. To implement these operations, according to an exemplary embodiment, the ransomware analysis engine 210 includes a feature extraction module 302, an encryption analysis module 304, a file naming analysis module 306, a content analysis module 308, a user feedback module 312, a learning engine 314, and an affected file identification module 310, all of which are configured to communicate with each other (e.g., via a bus, a shared memory, or a switch).

[0046] The feature extraction module 302 extracts features from files stored in the data store 206. In one example, the feature extraction module 302 extracts features from a newly modified file or a new file received from the client storage application 108 via the server storage application 202. Examples of features (also referred to as attributes or properties in this document) include, but are not limited to, attributes of a file, such as file encryption status, extension, creation date, modification date, version number, author name, media type, and compression status.

[0047] The encryption analysis module 304 determines the encryption status of the new or modified file based on the extracted file characteristics. For example, the encryption analysis module 304 determines that the encryption status of the modified file has changed (e.g., from unencrypted to encrypted: the modified file is now encrypted, while the previous version of the corresponding file was not encrypted). In another example, the encryption analysis module 304 determines that the new file has been encrypted. The encryption analysis module 304 provides the encryption status of the new or modified file to the affected file identification module 310.

[0048] The file naming analysis module 306 determines the file name of the new or modified file and the extension of the new or modified file based on the extracted features of the new or modified file. For example, the file naming analysis module 306 compares the name of the new or modified file with the name of a known ransomware file name. In another exemplary embodiment, the file naming analysis module 306 determines whether there is an increase in file renames in a folder of the data storage 206 corresponding to a folder in the client device 102. In other exemplary embodiments, the file naming analysis module 306 monitors text strings associated with known ransomware. The file naming analysis module 306 provides the ransomware file name matching results of the new or modified file to the affected file identification module 310.

[0049] The content analysis module 308 determines whether the content of the file does not match its file type (based on its extension, header, or mime type). For example, the content analysis module 308 determines that the content in the a.jpg file is not an image. The content analysis module 308 provides its content analysis results for the new or modified file to the affected file identification module 310.

[0050] The user feedback module 312 is configured to receive feedback (e.g., confirmation and verification of the presence of ransomware in new or modified files) from the client storage application 108 of the client device 102. For example, the user feedback module 312 receives a ransomware confirmation from the client storage application 108 based on user feedback at the client storage application 108. The user feedback indicates whether the new file or the modified file is indeed affected by the ransomware. The user feedback module 312 provides the user feedback (e.g., the ransomware confirmation 220) to the learning engine 314.

[0051] The learning engine 314 (e.g., a machine learning algorithm) manages a learning model for identifying ransomware files. The learning engine 314 accesses file information (associated with the client device 102) from the data store 206. The file information includes properties, extensions, and characteristics (including user feedback) of old, new, and modified files associated with the client device 102. Using the file information, the learning engine 314 can identify trends or patterns. For example, based on the file extension, the learning engine 314 learns that a new file is actually not related to the ransomware confirmed by the user of the client device 102 because the user has named the file similar to a name of known ransomware. In another example, the learning engine 314 learns that a file that is encrypted and has a file extension with a specific file naming pattern (e.g., previously associated with existing ransomware) is likely to be ransomware.

[0052] In one embodiment, based on the learning model, the learning engine 314 can suggest to the affected file identification module 310 that a new or modified file may or may not be ransomware. In a further embodiment, the learning engine 314 updates the list of files that have been confirmed or verified as safe (not affected by ransomware) from the client device 102. All trends or patterns identified by the learning engine 314 can be stored in the data store 206 and provided to the affected file identification module 310 for further processing.

[0053] In other exemplary embodiments, the learning engine 314 determines the number of files that are being updated, deleted, created, encrypted, and have suspicious extensions (in an account of the client device 102 in the data store 206) and generates a determination value or confidence level that one of these files (or the user account) has been attacked by malware or ransomware.

[0054] The affected file identification module 310 receives results from the encryption analysis module 304, the file naming analysis module 306, the content analysis module 308, and the learning engine 314 to determine whether a new or modified file is likely to be affected by ransomware. In an exemplary embodiment, the affected file identification module 310 provides a confidence range that the new or modified file is likely to be affected by ransomware. For example, the affected file identification module 310 determines that the modified file is likely to be affected by ransomware based on the following determinations: determining that the modified file is now encrypted (and the previous version of the modified file was unencrypted), determining that the file's extension matches a portion of a text string associated with known ransomware, and based on previous user feedback (from the client device 102 or from other users or client devices with files that share the same attributes or characteristics).

[0055] Figure 4 is a block diagram illustrating a method of interaction between components of a client device and a storage system according to an exemplary embodiment. Figure 1 and Figure 2 The operations in the interactive method 400 are performed between the described client-side ransomware detection application 110, the client-side ransomware coordination module 112, and the server-side ransomware coordination module 201. Therefore, the interactive method 400 is described illustratively with reference to the storage system 106 and the client device 102. However, it should be understood that at least some of the operations of the method 400 can be deployed on various other hardware configurations, or can be performed by similar components elsewhere. For example, some of these operations can be performed at a third-party device.

[0056] In operation 402, the client-side ransomware detection application 110 detects locally affected files (eg, suspicious files that may be affected by ransomware). The client-side ransomware detection application 110 includes an anti-malware detection application (eg, an anti-virus application).

[0057] In operation 404, client ransomware detection application 110 provides detection event information (e.g., information about locally affected files) and remediation flags (e.g., flags indicating that client device 102 has successfully cleaned (or failed to clean) affected files, and whether synchronized files on storage system 106 are also affected) to client ransomware coordination module 112.

[0058] In operation 406, the client-side ransomware coordination module 112 provides the detection event information and the remediation flag to the server-side ransomware coordination module 201. In another embodiment, the client-side ransomware coordination module 112 requests the client storage application 108 to pause or stop synchronizing with the server storage application 202 until the affected files are remediated.

[0059] In operation 408 , the server-side ransomware coordination module 201 suspends its server-side ransomware detection and notification and pauses synchronization with the client device 102 upon receiving a detection event.

[0060] At operation 410, the client-side ransomware detection application 110 remediates the affected files. At operation 412, the client-side ransomware detection application 110 confirms the remediation and notifies the client-side ransomware coordination module 112 of the remediation time (e.g., the time when the affected files have been remediated). At operation 414, the client-side ransomware coordination module 112 notifies the server-side ransomware coordination module 201 of the remediation. In response, at operation 416, the server-side ransomware coordination module 201, after receiving confirmation of the remediation and the remediation time, resumes server-side ransomware detection and / or notification and resumes synchronization with the client device 102.

[0061] In another example embodiment, at operation 418, the client-side ransomware detection application 110 determines that it cannot remediate the affected file locally and notifies the client-side ransomware coordination module 112 of the affected file that is not remediable. At operation 422, the client-side ransomware coordination module 112 determines a remediation time (e.g., a time when the file may not be affected by the ransomware) and provides the remediation time to the server-side ransomware coordination module 201. At operation 424, the server-side ransomware coordination module 201 retrieves an unaffected version of the file based on the remediation / detection time. At operation 426, the server-side ransomware coordination module 201 provides a file restore link to the client-side ransomware coordination module 112, which provides access to the unaffected version of the file. At operation 428, the client-side ransomware coordination module 112 provides the file restore link to the client-side ransomware detection application 110. At operation 430, the client-side ransomware detection application 110 restores the affected file to the unaffected version of the file by using the file restore link to access the unaffected version of the file from the data store 206.

[0062] Figure 5 is a block diagram illustrating the interaction between components of a client device and a storage system according to another exemplary embodiment. Figure 1 and Figure 2The operations in the interactive method 500 are performed between the described client-side ransomware detection application 110, the client-side ransomware coordination module 112, and the server-side ransomware coordination module 201. Therefore, the interactive method 500 is described illustratively with reference to the storage system 106 and the client device 102. However, it should be understood that at least some of the operations of the method 500 can be deployed on various other hardware configurations, or can be performed by similar components elsewhere. For example, some of these operations can be performed at a third-party device.

[0063] In operation 502 , the server-side ransomware coordination module 201 uses the ransomware analysis engine 210 to detect affected files (eg, suspicious files that may be affected by ransomware).

[0064] In operation 504, the server-side ransomware coordination module 201 provides the client-side ransomware coordination module 112 with detection event information (e.g., information about the locally affected files) and remediation flags (e.g., flags indicating that the storage system 106 has successfully cleaned (or failed to clean) the affected files, and whether the synchronized files on the client device 102 are also affected).

[0065] In operation 506, client ransomware coordination module 112 provides detection event information and remediation indicators to client ransomware detection application 110. In another embodiment, client ransomware coordination module 112 requests client storage application 108 to pause or stop synchronization with server storage application 202 until the affected files are remediated.

[0066] In operation 508, the client ransomware detection application 110, upon receiving the detection event, suspends synchronization with the storage system 106.

[0067] At operation 510, the server-side ransomware coordination module 201 remediates the affected files by retrieving the affected file versions based on the detection event (e.g., the detection time). At operation 512, the server-side ransomware coordination module 201 provides a file restore link to the client-side ransomware coordination module 112, which provides access to the unaffected file versions. At operation 514, the client-side ransomware coordination module 112 notifies the client-side ransomware detection application 110 and provides the file restore link. At operation 516, the client-side ransomware detection application 110 generates a server-side ransomware detection notification. At operation 518, the client-side ransomware detection application 110 uses the file restore link to restore the affected files. At operation 520, the client-side ransomware detection application 110 resumes ransomware detection and notification on the local side and resumes synchronization with the storage system 106.

[0068] Figure 6 is a flow chart of a method for coordinating ransomware detection at a storage system according to an exemplary embodiment. The operations in method 600 may be performed by storage system 106 using the method described above with reference to Figure 2 The method 600 is described in detail with reference to the storage system 106. However, it should be understood that at least some of the operations of the method 600 may be deployed on various other hardware configurations or may be performed by similar components elsewhere. For example, some of these operations may be performed at the client device 102.

[0069] At operation 602 , the server-side ransomware coordination module 201 receives a detection event from the client-side ransomware coordination module 112 , the detection event indicating that the client device 102 detected ransomware activity.

[0070] At operation 604 , the server-side ransomware coordination module 201 suspends server-side ransomware detection notifications to the client device 102 (eg, suspends operation of the notification engine 214 or the communication module 216 ).

[0071] At operation 606 , server-side ransomware coordination module 201 receives a remediation notification from client-side ransomware coordination module 112 indicating that the ransomware activity at client device 102 has been remediated.

[0072] At operation 608 , the server-side ransomware coordination module 201 updates the ransomware analysis engine 210 based on the detection events, remediation notifications, and information shared by the client-side ransomware coordination module 112 .

[0073] At operation 610 , server-side ransomware coordination module 201 resumes server-side ransomware detection notifications to client device 102 (eg, resumes operation of notification engine 214 or communication module 216 ).

[0074] Figure 7 is a flow chart of a method for coordinating ransomware detection at a storage system according to another exemplary embodiment. The operations in method 700 may be performed by storage system 106 using the method described above with reference to Figure 2 The method 700 is performed by the components (e.g., modules, engines) described herein. Therefore, the method 700 is described illustratively with reference to the storage system 106. However, it should be understood that at least some of the operations of the method 700 may be deployed on various other hardware configurations, or may be performed by similar components elsewhere. For example, some of these operations may be performed at the client device 102.

[0075] At operation 702 , the server-side ransomware coordination module 201 receives a detection event from the client-side ransomware coordination module 112 , the detection event indicating that the client device 102 detected a ransomware activity.

[0076] At operation 704 , the server-side ransomware coordination module 201 suspends server-side ransomware detection notifications to the client device 102 (eg, suspends operation of the notification engine 214 or the communication module 216 ).

[0077] At operation 706 , the server-side ransomware coordination module 201 suspends synchronization operations between the server storage application 202 and the client storage application 108 .

[0078] At operation 708 , server-side ransomware coordination module 201 receives a remediation notification from client-side ransomware coordination module 112 , the remediation notification indicating unremediable affected files at client device 102 (eg, client device 102 is unremediable).

[0079] At operation 710 , the server-side ransomware coordination module 201 updates the ransomware analysis engine 210 based on the detection events, remediation notifications, and information shared by the client-side ransomware coordination module 112 .

[0080] At operation 712 , the server-side ransomware coordination module 201 provides access to an unaffected version of the file based on the detection event and remediation notification and the information shared by the client-side ransomware coordination module 112 .

[0081] At operation 714 , the server-side ransomware coordination module 201 resumes server-side ransomware detection notifications to the client device 102 (eg, resumes operation of the notification engine 214 or the communication module 216 ).

[0082] At operation 716 , the server-side ransomware coordination module 201 resumes synchronization operations between the server storage application 202 and the client storage application 108 .

[0083] Figure 8 is a flow chart of a method for coordinating ransomware detection at a storage system according to an exemplary embodiment. The operations in method 800 may be performed by client device 102 using the method described above with reference to Figure 2 The method 800 is performed by the components (e.g., modules, engines) described herein. Therefore, the method 800 is described illustratively with reference to the client device 102. However, it should be understood that at least some of the operations of the method 800 may be deployed on various other hardware configurations, or may be performed by similar components elsewhere. For example, some of these operations may be performed at the storage system 106.

[0084] At operation 802 , client-side ransomware coordination module 112 receives a detection event from server-side ransomware coordination module 201 , the detection event indicating that storage system 106 detected ransomware activity.

[0085] At operation 804 , client ransomware coordination module 112 suspends client ransomware detection notifications from client ransomware detection application 110 .

[0086] At operation 806 , client-side ransomware coordination module 112 receives a remediation notification from server-side ransomware coordination module 201 indicating that the ransomware activity at storage system 106 has been remediated.

[0087] At operation 808 , client ransomware coordination module 112 provides the remediation notification to client ransomware detection application 110 .

[0088] At operation 810 , client ransomware coordination module 112 recovers detection notifications from client ransomware detection application 110 .

[0089] Fig. 9 is a flow chart of a method for determining ransomware activity in a storage system according to an exemplary embodiment. The operations in method 900 may be performed by storage system 106 using the method described above with reference to Figure 2 2. The method 900 may be performed by the components (e.g., modules, engines) described herein. Therefore, the method 900 is described illustratively with reference to the ransomware analysis engine 210. However, it should be understood that at least some of the operations of the method 900 may be deployed on various other hardware configurations or may be performed by similar components elsewhere. For example, some of these operations may be performed at the client device 102.

[0090] At operation 902, the encryption analysis module 304 identifies the encryption status of the new or modified file. For example, the encryption analysis module 304 determines whether the new or modified file is encrypted (if so, whether the previous previous version of the file stored in the data storage 206 is unencrypted).

[0091] In operation 904 , the file naming analysis module 306 identifies the file name of the new or modified file.

[0092] In operation 906 , the file naming analysis module 306 identifies the file extension of the new or modified file.

[0093] In operation 908, the content analysis module 308 identifies the content type of the new or modified file. For example, the content analysis module 308 determines that the content of the new or modified file does not match the extension of the new or modified file.

[0094] In operation 910 , the user feedback module 312 identifies previous user feedback (or other user feedback) related to the new or modified file.

[0095] In operation 912 , the affected file identification module 310 determines ransomware activity of the new or modified file based on the encryption status, file name, extension, content type, and previous feedback from the user.

[0096] Fig.10 is a flow chart of a method for determining ransomware activity in a storage system according to another exemplary embodiment. The operations in method 1000 may be performed by storage system 106 using the method described above with reference to Figure 2 1000 is performed by the components (e.g., modules, engines) described herein. Therefore, the method 1000 is described illustratively with reference to the ransomware analysis engine 210. However, it should be understood that at least some of the operations of the method 1000 may be deployed on various other hardware configurations or may be performed by similar components elsewhere. For example, some of these operations may be performed at the client device 102.

[0097] At operation 1002 , the user feedback module 312 receives previous feedback (from the user or other users) regarding a new or modified file stored at the storage system 106 .

[0098] In operation 1004 , the learning engine 314 trains a ransomware detection model for new or modified files based on the user's feedback.

[0099] In operation 1006, the feature extraction module 302 determines features of the new or modified file. Examples of features include encryption status, file or extension naming patterns, content analysis matching results, and user feedback regarding files similar to the new or modified file.

[0100] In operation 1008 , the affected file identification module 310 detects ransomware activity (eg, ransomware) based on the characteristics of the new or modified file as previously determined in operation 1006 and based on the ransomware detection model as previously determined in operation 1004 .

[0101] In operation 1010 , notification engine 214 generates a notification for client device 102 , wherein the notification identifies the new or modified file (based on the file identification from operation 1008 ) as potential ransomware. Communication module 216 sends the notification to client device 102 .

[0102] In operation 1012, the ransomware analysis engine 210 receives user confirmation of the ransomware activity that modified the file from the client device 102 via the communication module 216. The ransomware analysis engine 210 provides feedback (eg, user confirmation) to the learner 314 (in operation 1004).

[0103] Fig.11 1 is a block diagram showing components of a machine 1100 that is capable of reading instructions 1124 from a machine storage medium 1122 and performing, in whole or in part, any one or more of the methods discussed herein, according to some exemplary embodiments. Fig.11 A machine 1100 is shown in the example form of a computing device (e.g., a computer) in which instructions 1124 (e.g., software, programs, applications, applet, app, or other executable code) for causing the machine 1100 to perform any one or more of the methodologies discussed herein may be executed, either in whole or in part.

[0104] For example, instruction 1124 may cause machine 1100 to execute Figure 6-10 The instructions 1124 may transform a general purpose, non-programmed machine 1100 into a specific machine (eg, a specially configured machine) that is programmed to perform the functions described and illustrated in the manner described.

[0105] In alternative embodiments, the machine 1100 operates as a standalone device or can be connected (e.g., networked) to other machines. The machine 1100 can be a server computer, a client computer, a personal computer (PC), a tablet computer, a laptop computer, a netbook, a set-top box (e.g., STB), a personal digital assistant (PDA), a cellular phone, a smart phone, a network appliance, a network router, a network switch, a network bridge, a power adapter, or any machine 1100 capable of executing instructions 1124 (sequentially or otherwise) that specify operations to be performed by the machine 1100. In addition, while only a single machine is shown, the term "machine" should also be construed to include a collection of machines that individually or jointly execute instructions 1124 to perform any one or more of the methodologies discussed herein.

[0106] The machine 1100 includes a processor 1102 (e.g., a central processing unit (CPU), a graphics processing unit (GPU) 1103, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a radio frequency integrated circuit (RFIC), or any suitable combination thereof), a main memory 1104, and a static memory 1106, which are configured to communicate with each other via a bus 1108. The processor 1102 may include microcircuits that may be temporarily or permanently configured by some or all of the instructions 1124, so that the processor 1102 may be configured to perform any one or more of the methods described herein in whole or in part. For example, a group of one or more microcircuits of the processor 1102 may be configured to execute one or more modules (e.g., software modules) described herein.

[0107] The machine 1100 may also include a display device 1110 (e.g., a plasma display panel (PDP), a light emitting diode (LED) display, a liquid crystal display (LCD), a projector, a cathode ray tube (CRT), or any other display capable of displaying graphics or video). The machine 1100 may also include an alphanumeric input device 1112 (e.g., a keyboard or keypad), a UI navigation device 1114 (e.g., a mouse, a touch pad, a trackball, a joystick, a motion sensor, an eye tracking device, or other pointing tool), a storage unit 1116, a signal generating device 1118 (e.g., a sound card, an amplifier, a speaker, a headphone jack, or any suitable combination thereof), and a network interface device 1120.

[0108] The storage unit 1116 includes a machine-readable medium 1122 on which are stored instructions 1124 embodying any one or more of the methodologies or functions described herein. The instructions 1124 may also reside, in whole or in part, in the main memory 1104, the processor 1102 (e.g., in a cache memory of the processor), or both, before or during execution by the machine 1100. Thus, the main memory 1104 and the processor 1102 may be considered to be machine-readable media 1122 (e.g., tangible and non-transitory machine-readable media).

[0109] In some exemplary embodiments, the machine 1100 may be a portable computing device and have one or more other input components (e.g., sensors or meters). Examples of such input components include image input components (e.g., one or more cameras), audio input components (e.g., microphones), direction input components (e.g., compasses), position input components (e.g., global positioning system (GPS) receivers), orientation components (e.g., gyroscopes), motion detection components (e.g., one or more accelerometers), height detection components (e.g., altimeters), and gas detection components (e.g., gas sensors). Input collected by any one or more of these input components may be accessible and used by any of the modules described herein.

[0110] Executable instructions and machine storage media

[0111] Various memories (i.e., 1104, 1106 and / or the memory of the processor 1102) and / or the storage unit 1116 may store one or more sets of instructions and data structures (e.g., software) 1124 that embody or are used by any one or more of the methods or functions described herein. When these instructions are executed by the processor 1102, various operations are performed to implement the disclosed embodiments.

[0112] As used herein, the terms "machine storage medium," "device storage medium," "computer storage medium" (collectively, "machine-readable medium 1122") mean the same thing and may be used interchangeably in this disclosure. These terms refer to a single or multiple storage devices and / or media (e.g., centralized or distributed databases and / or associated caches and servers) that store executable instructions and / or data, as well as a cloud-based storage system or storage network that includes multiple storage devices or devices. Accordingly, these terms should be considered to include, but are not limited to: solid-state memory, and optical and magnetic media (including memory within or outside the processor). Specific examples of machine storage media, computer storage media, and / or machine-readable media 1122 include non-volatile memory, including, by way of example: semiconductor memory devices, such as erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), FPGAs, and flash memory devices; magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. The terms machine storage media, computer storage media, and machine-readable media expressly exclude carrier waveforms, modulated data signals, and other such media, at least some of which are encompassed by the term "signal media" discussed below.

[0113] Signal medium

[0114] The term "signal medium" or "transmission medium" shall include any form of modulated data signal, carrier wave, etc. The term "modulated data signal" means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal.

[0115] Computer readable medium

[0116] The terms "machine-readable medium," "computer-readable medium," and "device-readable medium" mean the same thing and may be used interchangeably in this disclosure. These terms are defined to include both machine storage media and signal media. Thus, these terms include both storage devices / media and carrier / modulated data signals.

[0117] The instructions 1124 may be further sent or received over a communication network 1126 using a transmission medium via the network interface device 1120 and utilizing any of a number of well-known transmission protocols (e.g., HTTP). Examples of communication networks 1126 include a local area network (LAN), a wide area network (WAN), the Internet, a mobile telephone network, a plain old telephone service (POTS) network, and wireless data networks (e.g., Wi-Fi, LTE, and WiMAX networks). The term "transmission medium" or "signal medium" shall be taken to include any intangible medium that is capable of storing, encoding, or carrying the instructions 1124 for execution by the machine 1100, and includes digital or analog communication signals or other intangible media to facilitate communication of such software.

[0118] Throughout the entire specification, multiple instances can implement components, operations or structures described as single instances. Although the individual operations of one or more methods are shown and described as separate operations, one or more of these single operations can be performed simultaneously, and these operations do not need to be performed in the order shown. The structure and function presented as a separate component in the example configuration can be implemented as a combined structure or component. Similarly, the structure and function presented as a single component can be implemented as a separate component. These and other variations, modifications, additions and improvements all fall within the scope of protection of this article theme.

[0119] Certain embodiments are described herein as including logical or multiple components, modules, or mechanisms. Modules may constitute software modules (e.g., code embodied on machine storage medium 1122 or signal media) or hardware modules. A "hardware module" is a tangible unit capable of performing certain operations and may be configured or arranged in some physical manner. In various example embodiments, one or more computer systems (e.g., stand-alone computer systems, client computer systems, or server computer systems) or one or more hardware modules of a computer system (e.g., processor 1102 or a group of processors 1102) may be configured by software (e.g., an application or application portion) as a hardware module that performs certain operations described herein.

[0120] In some embodiments, the hardware module can be implemented mechanically, electronically, or in any suitable combination thereof. For example, the hardware module may include a dedicated circuit or logic that is permanently configured to perform certain operations. For example, the hardware module may be a dedicated processor, such as a field programmable gate array (FPGA) or an ASIC. The hardware module may also include a programmable logic or circuit that is temporarily configured by software to perform certain operations. For example, the hardware module may include software contained in a general-purpose processor or other programmable processor. It should be understood that the hardware module may be implemented mechanically in a dedicated and permanently configured circuit or in a temporarily configured circuit (e.g., configured by software) based on cost and time considerations.

[0121] Therefore, the phrase "hardware module" should be understood to cover tangible entities, referring to entities that are physically constructed, permanently configured (e.g., hardwired) or temporarily configured (e.g., programmed) to operate in a certain manner or perform certain operations described herein. As used herein, a "hardware-implemented module" refers to a hardware module. Considering an embodiment in which a hardware module is temporarily configured (e.g., programmed), each hardware module does not need to be configured or instantiated at any time in a timely manner. For example, in the case where the hardware module includes a general-purpose processor configured as a special-purpose processor by software, the general-purpose processor can be configured as different special-purpose processors (e.g., including different hardware modules) at different times. The software can configure the processor accordingly, for example, to constitute a specific hardware module at one time instance and to constitute different hardware modules at different time instances.

[0122] The various operations of the example methods described herein may be performed, at least in part, by one or more processors that are temporarily configured (e.g., by software) or permanently configured to perform the relevant operations. Such processors, whether temporarily or permanently configured, may constitute processor-implemented modules that may perform one or more operations or functions described herein. As used herein, a "processor-implemented module" refers to a hardware module implemented using one or more processors.

[0123] Similarly, the methods described herein may be implemented at least in part by a processor, which is an example of hardware. For example, at least some of the operations of a method may be performed by one or more processors or processor-implemented modules. In addition, the one or more processors may also support the execution of related operations in a "cloud computing" environment or as "software as a service" (SaaS). For example, at least some of these operations may be performed by a group of computers (e.g., a machine containing a processor), which may be accessed via a network (e.g., the Internet) and one or more appropriate interfaces (e.g., an application program interface (API)).

[0124] The performance of certain operations can be distributed among one or more processors, not only residing in a single computer, but also deployed across multiple computers. In some exemplary embodiments, the one or more processors or processor-implemented modules can be located in a single geographic location (e.g., in a home environment, an office environment, or a server farm). In other exemplary embodiments, the one or more processors or processor-implemented modules can be distributed in multiple geographic locations.

[0125] Some parts of this specification may be introduced using algorithms or symbolic representations of operations on data stored as bits or binary digital signals in machine memory (e.g., computer memory). These algorithms or symbolic representations are examples of techniques used by ordinary technicians in the field of data processing to convey the essence of their work to other technicians in the field. As used herein, an "algorithm" is a self-consistent sequence of operations or similar processes that lead to a desired result. In this environment, algorithms and operations involve physical manipulation of physical quantities. Typically, but not necessarily, these quantities can take the form of electrical, magnetic or optical signals that can be stored, accessed, transmitted, combined, compared or otherwise manipulated by a machine. Mainly for general purposes, words such as "data", "content", "bit", "value", "element", "symbol", "character", "item", "number", "digital symbol", etc. are sometimes used to refer to these signals. However, these words are only convenient labels and should be associated with appropriate physical quantities.

[0126] Unless otherwise expressly stated, discussions herein using terms such as "processing," "computing," "calculating," "determining," "presenting," "displaying," and the like may refer to the action or process of a machine (e.g., a computer) that manipulates or transforms data represented as physical (e.g., electrical, magnetic, or optical) quantities in one or more memories (e.g., volatile memory, non-volatile memory, or any suitable combination thereof), registers, or other machine components that receive, store, transmit, or display information. Furthermore, unless otherwise expressly stated, as used in patent documents, the terms "a" or "an" are used herein to include one or more instances. Finally, unless otherwise expressly stated, as used herein, the conjunction "or" refers to an exclusive "or."

[0127] Example

[0128] Example 1 is a system for detecting ransomware in a storage device of a server. The system includes: one or more hardware processors; and a memory storing instructions, which, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations including: receiving a detection notification from a client device at a cloud storage server, the cloud storage server being configured to store a file received from the client device, the detection notification indicating a ransomware activity detected by the client device; receiving a remediation notification from the client device at the cloud storage server, the remediation notification indicating that the client device has remediated the ransomware activity; and updating the operation of the cloud storage server based on the detection notification and the remediation notification.

[0129] In Example 2, the subject matter of Example 1 may optionally include: wherein the detection notification comes from a client-based cloud storage application running at the client device or a client-based ransomware detection application running at the client device, and the detection notification indicates the ransomware activity detected by the client-based ransomware detection application.

[0130] In Example 2, the subject matter of Example 1 may optionally include: wherein the remediation notification comes from the client-based cloud storage application running at the client device or the client-based ransomware detection application running at the client device, and the remediation notification indicates that the client-based ransomware detection application has remediated the ransomware activity.

[0131] In Example 4, the subject matter of Example 1 may optionally include: wherein the operation of updating the cloud storage server includes: an operation of updating a server-based ransomware detection application at the cloud storage server based on the detection notification and the remediation notification.

[0132] In Example 5, the subject matter of Example 4 may optionally include: wherein the operation of updating the server-based ransomware detection includes: pausing synchronization operations between a client-based cloud storage application at the client device and the cloud storage server in response to receiving the detection notification at the cloud storage server; and resuming the synchronization operations between the client-based cloud storage application and the cloud storage server in response to receiving the remediation notification at the cloud storage server.

[0133] In Example 6, the subject matter of Example 4 may optionally include: wherein the operation of updating the server-based ransomware detection comprises: in response to receiving the detection notification at the cloud storage server, performing a synchronization operation between a client-based cloud storage application at the client device and the cloud storage server; and in response to receiving the detection notification at the cloud storage server, receiving one or more remediated files from a client-based ransomware detection application or the client-based cloud storage application.

[0134] In Example 7, the subject matter of Example 1 may optionally include: wherein the detection notification includes: an identification of one or more files compromised by the ransomware activity and a timestamp of detection of the ransomware activity by the client-based ransomware detection application, wherein the remediation notification includes an identification of one or more remediated files and a timestamp of remediation of the ransomware activity by the client-based ransomware detection application.

[0135] Example 8 is a computer-implemented method, the computer-implemented method comprising: generating, at a cloud storage server, a detection notification for a client device, the cloud storage server being configured to store files received from the client device, the detection notification indicating ransomware activity detected by the cloud storage server; transmitting a remediation notification from the cloud storage server to the client device, wherein the remediation notification indicates that the cloud storage server has remediated the ransomware activity; and updating an operation of the cloud storage server based on the detection notification and the remediation notification.

[0136] In Example 9, the subject matter of Example 8 may optionally include: wherein the detection notification comes from a server-side ransomware coordination module running at the cloud storage server, the detection notification indicating the ransomware activity detected by a ransomware analysis engine of the cloud storage server.

[0137] In Example 10, the subject matter described in Example 9 may optionally include: pausing the synchronization operation between the client-based cloud storage application at the client device and the cloud storage server in response to generating the detection notification at the cloud storage server; and resuming the synchronization operation between the client-based cloud storage application and the cloud storage server in response to receiving the remediation notification at the cloud storage server.

[0138] Example 11 is a system. The system includes: one or more hardware processors; and a memory storing instructions, which, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations including: receiving a detection notification from a client device at a cloud storage server, the cloud storage server being configured to store a file received from the client device, the detection notification indicating a ransomware activity detected by the client device; receiving a remediation notification from the client device at the cloud storage server, the remediation notification indicating that the client device has remediated the ransomware activity; and updating the operation of the cloud storage server based on the detection notification and the remediation notification.

[0139] In Example 12, the subject matter of Example 11 may optionally include: wherein the detection notification comes from a client-based cloud storage application running at the client device or a client-based ransomware detection application running at the client device, and the detection notification indicates the ransomware activity detected by the client-based ransomware detection application.

[0140] In Example 13, the subject matter of Example 12 may optionally include: wherein the remediation notification comes from the client-based cloud storage application running at the client device or the client-based ransomware detection application running at the client device, and the remediation notification indicates that the client-based ransomware detection application has remediated the ransomware activity.

[0141] In Example 14, the subject matter of Example 11 may optionally include: wherein the operation of updating the cloud storage server includes:

[0142] Based on the detection notification and the remediation notification, operation of a server-based ransomware detection application at the cloud storage server is updated.

[0143] In Example 15, the subject matter of Example 14 may optionally include: wherein the operation of updating the server-based ransomware detection comprises:

[0144] In response to receiving the detection notification at the cloud storage server, pausing synchronization operations between a client-based cloud storage application at the client device and the cloud storage server; and

[0145] In response to receiving the remediation notification at the cloud storage server, the synchronization operation between the client-based cloud storage application and the cloud storage server is resumed.

[0146] In Example 16, the subject matter of Example 14 may optionally include: wherein the operation of updating the server-based ransomware detection comprises:

[0147] In response to receiving the detection notification at the cloud storage server, performing a synchronization operation between a client-based cloud storage application at the client device and the cloud storage server; and

[0148] In response to receiving the detection notification at the cloud storage server, one or more remediated files are received from a client-based ransomware detection application or the client-based cloud storage application.

[0149] In Example 17, the subject matter of Example 11 may optionally include: wherein the detection notification includes: an identification of one or more files compromised by the ransomware activity and a timestamp of a detection of the ransomware activity by a client-based ransomware detection application,

[0150] The remediation notification includes an identification of one or more remediated files and a timestamp of when the client-based ransomware detection application remediated the ransomware activity.

[0151] Example 18 is a machine storage medium storing instructions that, when executed by one or more processors of a machine, cause the one or more processors to perform operations including:

[0152] receiving, at a cloud storage server, a detection notification from a client device, the cloud storage server being configured to store a file received from the client device, the detection notification indicating ransomware activity detected by the client device; receiving, at the cloud storage server, a remediation notification from the client device, wherein the remediation notification indicates that the client device has remediated the ransomware activity; and

[0153] Based on the detection notification and the remediation notification, the operation of the cloud storage server is updated.

[0154] In Example 19, the subject matter of Example 18 may optionally include: wherein the detection notification comes from a client-based cloud storage application running at the client device or a client-based ransomware detection application running at the client device, and the detection notification indicates the ransomware activity detected by the client-based ransomware detection application.

[0155] In Example 20, the subject matter of Example 19 may optionally include: wherein the remediation notification comes from the client-based cloud storage application running at the client device or the client-based ransomware detection application running at the client device, and the remediation notification indicates that the client-based ransomware detection application has remediated the ransomware activity.

[0156] Although the overview of the subject matter has been described with reference to specific exemplary embodiments, various modifications and changes may be made to these embodiments without departing from the broader scope of the embodiments of the present invention. For example, one of ordinary skill in the art may mix and match the various embodiments or features thereof, or make them optional. These embodiments of the subject matter of the present invention may be referred to herein individually or collectively by the term "invention", but this is only for convenience and is not intended to automatically limit the scope of protection of the present application to any single invention or given concept (if multiple, multiple are actually disclosed).

[0157] It is believed that the details described in the embodiments illustrated herein are not sufficient to enable one of ordinary skill in the art to practice the disclosed teachings. Other embodiments may be used and derived therefrom, so that structural and logical substitutions and changes may be made without departing from the scope of the present disclosure. Therefore, the specific embodiments should not be understood in a limiting sense, and the scope of the various embodiments is defined only by the appended claims and the full scope of equivalents to which these claims are entitled.

[0158] In addition, multiple instances may be provided for resources, operations, or structures described herein as single instances. In addition, the boundaries between various resources, operations, modules, engines, and data stores are somewhat arbitrary, and specific operations are described in the context of a specific exemplary configuration. Other allocations of functions may be envisioned, and they may fall within the scope of various embodiments of the present invention. Typically, structures and functions presented as separate resources in an exemplary configuration may be implemented as combined structures or resources. Similarly, structures and functions presented as single resources may be implemented as separate resources. These and other variations, modifications, additions, and improvements fall within the scope of embodiments of the present invention as represented by the appended claims. Therefore, the specification and drawings should be considered illustrative rather than restrictive.

Claims

1. A computer-implemented method, wherein include: receiving, at a cloud storage server from a client device, a detection notification, the cloud storage server being configured to store files received from the client device, the detection notification indicating ransomware activity detected by the client device; In response to receiving the detection notification from the client device, pausing, at the cloud storage server, server-based ransomware detection notifications designated for the client device without transmitting the server-based ransomware detection notifications to the client device; receiving, at the cloud storage server, a remediation notification from the client device, the remediation notification including a remediation flag indicating that the client device has successfully cleaned files affected by the ransomware activity; in response to receiving the remediation notification from the client device, restoring, at the cloud storage server, the server-based ransomware detection notification designated for the client device; as well as An operation of updating the cloud storage server based on the detection notification and the remediation notification.

2. The method according to claim 1, in, The detection notification is from a client-based cloud storage application running at the client device or a client-based ransomware detection application running at the client device, the detection notification indicating the ransomware activity detected by the client-based ransomware detection application.

3. The method according to claim 2, in, The remediation notification is from the client-based cloud storage application running at the client device or the client-based ransomware detection application running at the client device, the remediation notification indicating that the client-based ransomware detection application has remediated the ransomware activity.

4. The method according to claim 1, in, The operation of updating the cloud storage server includes: Operation of updating a server-based ransomware detection application at the cloud storage server based on the detection notification and the remediation notification.

5. The method according to claim 4, in, The operation of updating the server-based ransomware detection includes: In response to receiving the detection notification at the cloud storage server, pausing synchronization operations between a client-based cloud storage application at the client device and the cloud storage server; and In response to receiving the remediation notification at the cloud storage server, the synchronization operation between the client-based cloud storage application and the cloud storage server is resumed.

6. The method according to claim 4, in, The operation of updating the server-based ransomware detection includes: In response to receiving the detection notification at the cloud storage server, performing a synchronization operation between a client-based cloud storage application at the client device and the cloud storage server; and In response to receiving the detection notification at the cloud storage server, one or more remediated files are received from a client-based ransomware detection application or the client-based cloud storage application.

7. The method according to claim 1, in, The detection notification includes an identification of one or more files compromised by the ransomware activity and a timestamp of a detection of the ransomware activity by a client-based ransomware detection application, The remediation notification includes an identification of one or more remediated files and a timestamp of when the client-based ransomware detection application remediated the ransomware activity.

8. A machine-readable medium carrying processor-readable instructions, which, when executed by at least one processor of a machine, causes the machine to perform the method of any one of claims 1 to 7.

9. A computing system, wherein include: one or more hardware processors; as well as A memory storing instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations including: receiving, at a cloud storage server from a client device, a detection notification, the cloud storage server being configured to store files received from the client device, the detection notification indicating ransomware activity detected by the client device; In response to receiving the detection notification from the client device, pausing, at the cloud storage server, server-based ransomware detection notifications designated for the client device without transmitting the server-based ransomware detection notifications to the client device; receiving, at the cloud storage server, a remediation notification from the client device, the remediation notification including a remediation flag indicating that the client device has successfully cleaned files affected by the ransomware activity; in response to receiving the remediation notification from the client device, restoring, at the cloud storage server, the server-based ransomware detection notification designated for the client device; as well as An operation of updating the cloud storage server based on the detection notification and the remediation notification.

10. The computing system according to claim 9, in, The detection notification is from a client-based cloud storage application running at the client device or a client-based ransomware detection application running at the client device, the detection notification indicating the ransomware activity detected by the client-based ransomware detection application.

11. The computing system according to claim 10, in, The remediation notification is from the client-based cloud storage application running at the client device or the client-based ransomware detection application running at the client device, the remediation notification indicating that the client-based ransomware detection application has remediated the ransomware activity.

12. The computing system according to claim 9, in, The operation of updating the cloud storage server includes: Operation of updating a server-based ransomware detection application at the cloud storage server based on the detection notification and the remediation notification.

13. The computing system according to claim 12, in, The operation of updating the server-based ransomware detection includes: In response to receiving the detection notification at the cloud storage server, pausing synchronization operations between a client-based cloud storage application at the client device and the cloud storage server; and In response to receiving the remediation notification at the cloud storage server, the synchronization operation between the client-based cloud storage application and the cloud storage server is resumed.

14. The computing system of claim 12, in, The operation of updating the server-based ransomware detection includes: In response to receiving the detection notification at the cloud storage server, performing a synchronization operation between a client-based cloud storage application at the client device and the cloud storage server; and In response to receiving the detection notification at the cloud storage server, one or more remediated files are received from a client-based ransomware detection application or the client-based cloud storage application.

15. The computing system of claim 9, in, The detection notification includes an identification of one or more files compromised by the ransomware activity and a timestamp of a detection of the ransomware activity by a client-based ransomware detection application, The remediation notification includes an identification of one or more remediated files and a timestamp of when the client-based ransomware detection application remediated the ransomware activity.

Images