Method and arrangement for preventing threat related to file share, computer program, and computer-readable medium

Abstract

To provide a method for preventing file share-related threats in a computer.SOLUTION: A method for preventing file share-related threats comprises: intercepting an attempt to access a file, such as an attempt to modify, create, or delete a file, in a monitored location of a computer file system; determining a user identification of a user attempting to access the file; creating a backup copy of the file; allowing the attempt to access the file in a monitored location of computer file system; after the user accesses the file, checking corruption of the file; tracking multiple files accessed with the same user session based on the determined user identification; if more than a predefined number of files have been corrupted by the same user identification, blocking access of the user to the computer; and restoring the accessed and / or modified files from the backup copies of the files.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to an arrangement and method for threat detection in a computer or computer network. [Background technology]

[0002] Threat detection is a critical issue for computer and network security of all kinds. For example, threat or malware detection generally concerns identifying and potentially disinfecting any type of malware on a computer and / or communication system, such as, for example, a virus, a Trojan horse, a worm, or other type of security threat.

[0003] One of the threats that computers face is ransomware, a class of malware that encrypts files on a computer and demands a ransom before the files can be restored. Systems and solutions exist that can detect at least some of the ransomware-based threats.

[0004] One of the key areas to protect against ransomware is the defense of shared files and storage locations. Shared folders allow multiple users to access the same files on a shared folder or site, and often all users can read, modify, and delete the files. Shared folders are accessible via network manager and can be seen on local machines as a path (e.g., \\server\share). On a file server, a shared file or folder is for example stored in a local folder on the server and access can be given to users via network manager. If a computer accessing a shared file or folder becomes infected with ransomware, the ransomware can also encrypt the shared file or files on the shared folder. Such an outbreak can cause significant damage to an organization as it can hinder the work process of all other users. It may also require taking the file server offline. Summary of the Invention [Problem to be solved by the invention]

[0005] A problem with prior art solutions to file sharing related ransomware threats is that they are unable to reliably and efficiently detect file sharing related threats or handle situations caused by ransomware in file sharing environments. It is therefore desirable to provide an efficient file sharing related threat detection that can operate efficiently. [Means for solving the problem]

[0006] The following presents a simplified summary in order to provide a basic understanding of some aspects of various invention embodiments. This summary is not an extensive overview of the invention. It is not intended to identify key or critical elements of the invention or to delineate the scope of the invention. The following summary merely presents some concepts of the invention in a simplified form as a prelude to a more detailed description of example embodiments of the invention.

[0007] According to a first aspect, the present application relates to a method, e.g., a computer-implemented method, for preventing threats related to file sharing in a computer, such as a server, or a computer network. The present application includes intercepting a file access attempt, such as an attempt to modify, create, rename, and / or delete a file in a monitored location of a computer file system, e.g., a folder of a server, determining a user identity of a user, e.g., a remote user, attempting the file access, creating a backup copy of the file, and allowing the file access attempt in the monitored location of the computer file system, e.g., a shared folder, after creating the backup copy of the file. The present application includes checking for file corruption after the file access by the user is terminated, tracking multiple files accessed in the same user session based on the determined user identity, blocking the user access to a computer, such as a server, if more than a predetermined number of files are corrupted by the same user identity, and restoring the accessed and / or modified files from the backup copy of the file.

[0008] In one aspect of the present application, only files of predefined file types, for example compressed file types such as ZIP files, image files such as JPG files, and / or executable files such as EXE files, are checked for file corruption.

[0009] In one aspect of the present application, checking for file corruption includes checking the selected file by parsing the file, for example by parsing a file structure of the file.

[0010] In one aspect of the present application, checking for file corruption includes analyzing the file structure based on the type of the file, for example by recognizing the file's magic bytes.

[0011] In one aspect of the present application, checking for file corruption after accessing the file includes comparing the created backup copy with the latest version of the file and / or checking whether either or both of the files are corrupted.

[0012] In one aspect of the present application, checking for file corruption includes determining the ASCII ratio of the file, for example, the ratio of the total number of ASCII characters in the file to the total number of bytes in the file.

[0013] In one aspect of the present application, if less than a predetermined number of files are corrupted by the same user identification, the user is allowed access to the server for a predetermined period of time without tracking or checking the files accessed by the user.

[0014] In one aspect of the present application, the files accessed and / or analyzed are grouped by user to determine which user sessions are malicious.

[0015] In one aspect of the present application, the user session is a session that includes essentially all operations performed by different processes from a process tree or a session that includes essentially all operations performed by a user per network session.

[0016] In one aspect of the present application, the user identity is a global user identity (ID) of the server or service.

[0017] In one aspect of the present application, a list of analyzed file types and / or file type determination methods is received, eg, periodically, from a server, such as a backend server.

[0018] According to a second aspect, the present application relates to an arrangement for preventing threats related to file sharing in a computer or computer network, the arrangement including at least one computer, such as a server. The computer is configured to intercept file access attempts, such as attempts to modify, create, rename and / or delete a file in a monitored location of a computer file system, such as a folder of a server, determine a user identity of a user, such as a remote user, attempting the file access, and create a backup copy of the file. The computer is further configured to allow the file access attempt in the monitored location of the computer file system, such as a shared folder, after creating the backup copy of the file, check for file corruption after the file access by the user is terminated, keep track of multiple files accessed in the same user session based on the determined user identity, block user access to a computer, such as a server, if more than a predetermined number of files are corrupted by the same user identity, and restore the accessed and / or modified files from the backup copy of the file.

[0019] In one aspect of the present application, the arrangement is configured to perform the method of any of the aspects of the present application.

[0020] According to a third aspect of the present application, the present application relates to a computer program comprising instructions which, when executed by a computer, cause the computer to carry out the method of the present application.

[0021] According to a fourth aspect of the present application, the present application relates to a computer readable medium comprising the computer program of the present application. Effect of the Invention

[0022] The solution of the present invention can reliably and efficiently detect file sharing related threats and / or ransomware. It can also be used to address situations caused by ransomware in file sharing environments, so that computers infected by ransomware cannot affect shared files and files on shared folders. In the solution of the present invention, a server (including, for example, a file server) can monitor remote users and their behavior, and if a user with malicious activity is identified, the server can block the user's access and revert changes made on the server by the identified user with malicious activity. [Brief description of the drawings]

[0023] [Figure 1] 1 illustrates, in schematic form, a computer system or computer network configuration in which an exemplary embodiment of the present invention may be applied; [Diagram 2] 1 illustrates a schematic diagram of an exemplary embodiment of the inventive solution; [Diagram 3] 1 illustrates an exemplary method according to one embodiment of the present invention. [Figure 4] 1 shows, in schematic form, an example of the structure of an apparatus according to an exemplary embodiment of the present invention; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0024] Various illustrative and non-limiting embodiments of the present invention, both as to structure and method of operation, together with additional objects and advantages thereof, will be best understood from the following description of specific illustrative and non-limiting embodiments when read in connection with the accompanying drawings.

[0025] The word "comprise" and its equivalent verbs are used in this specification as an open limitation which does not exclude or require the presence of any unrecited features. Features recited in the dependent claims may be freely combined with each other, unless expressly stated otherwise.

[0026] Embodiments of the present invention are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings.

[0027] Furthermore, it will be understood that throughout this specification the use of "a" and its singular equivalents does not exclude a plural.

[0028] Fig. 1 shows an environment in which the solution of the present invention can be used. In the solution of Fig. 1, a system configuration is shown in which a user computer 1 and a server computer 2 are connected via a network 3. Here, the user computer 1 and the server exemplify any computing device, computer, or communication system, including a single device, a network node, or a combination of devices. For example, the server 2 can include or be connected to a security entity or a back-end entity of a security provider, etc., and the server 2 can be implemented as a cloud implementation, etc.

[0029] Network 3 illustrates any computer or communication network, including, for example, a local area network (wired or wireless), such as a LAN, WLAN, Ethernet, etc., a wide area network (wired or wireless), such as WiMAX, GSM, UMTS, LTE, etc. Thus, user computer 1 and server 2 can, but need not, be located in different locations. For example, network 3 can be any type of TCP / IP-based network. Communication between host 1 and server 2 over network 3 can be accomplished using, for example, any standard or proprietary protocol carried over TCP / IP.

[0030] In the example of Figure 1, there are multiple users accessing files on shared folder 4 with their computers. The users can read, modify and delete files in shared folder 4 with their computers. Shared folder 4 is accessible, for example, via a network manager and can be seen, for example, as a path \\sever\share on the users' computers. On server 2, such as a file server, the files can be stored in a local folder, for example, c:\share, and this folder can be shared for the users via the network manager.

[0031] The present invention relates to a method, e.g., a computer-implemented method, for preventing file sharing related threats in a computer, such as a server, or a computer network. The method includes intercepting attempts to access, e.g., modify, create, rename, and / or delete a file in a monitored location of the computer's file system, e.g., a folder on the server, determining a user identity of a user, e.g., a remote user, attempting to access the file, creating a backup copy of the file, and allowing the attempt to access the file in the monitored location of the computer's file system, e.g., a shared folder. The method further includes checking for corruption of the file after the user's access to the file is closed after creating the backup copy of the file, tracking multiple accessed files in the same user session based on the determined user identity, blocking the user's access to the computer, such as a server, if more than a predetermined number of files are corrupted by the same user identity, and restoring the accessed and / or modified files from the backup copy of the file. In one embodiment of the present invention, these steps are performed in the server, and in this way the server can detect and prevent file sharing related threats, e.g., threats from remote users and their computers that may be compromised and infected.

[0032] FIG. 2 illustrates one exemplary embodiment of the present invention. In this exemplary embodiment, a scenario is shown in which a user writes a file to a shared folder \\server\share, and the folder is mapped to a local folder on the file server, for example, c:\share. The data of the file to be saved is received from the user computer to the server over the network. To save the data network manager, for example, a worker kernel thread can be executed. The thread can impersonate the security credentials of the original user, and the user can be identified by a user ID, such as a SID (global ID on the server). The thread can create a file in the shared folder on a local file system in the server. The security manager function can use the impersonation to verify that the user has access permissions. File creator information can be assigned to the identified user. The worker thread can save the received content to a local file on the server.

[0033] A kernel file filter driver can be utilized in the solution of the present invention that can intercept file system events. In one embodiment of the present invention, a filter driver can be used to implement at least one embodiment of the present invention to protect a server's local folders from ransomware encryption.

[0034] In an exemplary embodiment, based on a detected attempt to modify or create a file on the server, a created file with write permission or delete or rename file in a protected shared folder may be intercepted at the server, for example, by a filter driver. The identity of the user, for example, a user impersonation SID, may be determined, for example, by a filter driver, and a check may be made to see if this user (e.g., SID) has not been handled recently. If the user has not been handled before, a shadow copy of the accessed file may be created, for example, by a filter driver. The requested changes to the file by the remote user computer are then allowed. When the file is closed, it may be checked whether the modified file is corrupted. The corruption check may be performed, for example, in the manner described in this application, by comparing a backup copy with the most recent changes. Multiple files in the same user session may be tracked, and if more than a certain number of files are corrupted, it may be determined that the user is a malicious actor. The user's access to the server may be blocked, and the modified files may be restored from a shadow backup, based on the determination that the user is a malicious actor. In one exemplary embodiment, the threshold level may be set, for example, at any number between 1 and 10 (e.g., 1, 2, 3, 4, 5, 6, 7, 8, 9, 10) of corrupted files within the same user session to determine a user as malicious.

[0035] In one embodiment of the present invention, the accessed and / or analyzed files are grouped by user to determine which user sessions are malicious. In one embodiment of the present invention, a user session is a session that includes essentially all operations performed by different processes from a process tree or a session that includes essentially all operations performed by a user per network session. In one embodiment of the present invention, the user identity is a global user identity (ID) on a server or service.

[0036] In one embodiment of the present invention, if after analyzing a certain number of files, a threshold number of corrupted files is not reached, it can be determined that the user is a legit user. In this case, changes made by that particular user can be permitted, and files modified by the user are not tracked and / or monitored for a predefined period of time. In one embodiment of the present invention, after the predefined period has expired, the user and files accessed by the user in the shared folder are tracked according to the solution of the present invention.

[0037] In one embodiment of the invention, checking for file corruption may be based at least in part on recognizing the format of the file, e.g., ZIP, PE, image, and / or parsing the structure of the file using a correspondent format parser. For example, the following properties of the file may be analyzed: for compressed files such as ZIP files, a list of files within the compressed file may be fetched, for executable files such as PE files, headers and sections may be loaded and analyzed, and for image files, headers, colors, sizes, and other properties may be loaded and analyzed. In one embodiment of the invention, if the parser fails to process the analyzed file, it may be determined that the file is corrupted.

[0038] In one embodiment of the present invention, only files that are predefined file types (e.g., compressed file types such as ZIP files, image files such as JPG files, and / or executable files such as EXE files) are checked for file corruption.

[0039] In one embodiment of the present invention, checking for file corruption involves analyzing the file structure based on the type of file, for example by recognizing the file's magic bytes.

[0040] In one embodiment of the present invention, checking for file corruption includes determining the ASCII ratio of the file, eg, the ratio of the total number of ASCII characters in the file to the total number of bytes in the file.

[0041] In one embodiment of the present invention, checking for file corruption after accessing the file includes comparing a created backup copy with the latest version of the file and / or checking whether either or both of these files are corrupted.

[0042] In one embodiment of the present invention, a list of analyzed file types and / or file type determination methods is received from a server, such as a backend server, for example periodically.

[0043] One embodiment of the present invention also relates to a solution for recognizing file encryption on a user computing device, e.g., a user computer, thereby executing ransomware on the user computing device. In this case, recognizing file corruption after the file has been accessed does not need to be related to file sharing, but rather to the file on the user computing device. In this embodiment, determining the file for corruption (e.g., the file being accessed by the user computer) can be done as described above in the file sharing related embodiment of the present invention.

[0044] 3 illustrates an exemplary method according to an embodiment of the present invention. The exemplary method includes intercepting attempts to access a file, such as attempts to modify, create, rename, and / or delete a file, at a monitored location of a computer file system in a folder on a server, determining a user identity of a user, such as a remote user, creating a backup copy of the file, and enabling attempts to access the file in the monitored location of the computer file system, such as a shared folder. The method further includes checking for corruption of the file after the user's access to the file is closed after creating the backup copy of the file, tracking multiple accessed files in the same user session based on the determined user identity, blocking the user's access to a computer, such as a server, if more than a predetermined number of files are corrupted by the same user identity, and restoring the accessed and / or modified files from the backup copy of the file.

[0045] As an example, Figure 4 illustrates some exemplary components of a user computer or server that may be used in the solutions of the present invention. As shown in Figure 4, a computing device 410, such as a user computer or server, or at least a portion of a computing device, may include at least one processor 411 and at least one memory 412, and possibly at least one interface 413, each of which may be operatively connected or coupled, for example, by a bus 414 or the like.

[0046] The processor 411 of the computing device 410 is configured to read and execute computer program codes stored in the memory 412. The processor may be represented by a Central Processing Unit (CPU), a Micro Processor Unit (MPU), etc., or a combination thereof. The memory 412 of the computing device 410 is configured to store computer program codes, such as respective programs, computer / processor executable instructions, macros or applets, etc., or portions thereof. Such computer program codes, when executed by the processor 411, enable the computing device 410 to operate according to the present embodiment. The memory 412 may be represented by a Random Access Memory (RAM), a Read Only Memory (ROM), a hard disk, a secondary storage device, etc., or a combination of two or more of these. The interface 413 of the computing device 410 is configured to interface with another computing device and / or a user of the computing device 410. That is, the interface 413 may represent a communications interface (including, for example, a modem, an antenna, a transmitter, a receiver, a transceiver, etc.) and / or a user interface (display, touch screen, keyboard, mouse, signal lights, loudspeakers, etc.).

[0047] The user computer and / or server may also be equipped with other defenses to prevent malware-related threats, such as similar threats mentioned above or other types of malware-related threats. The defenses may include, for example, a real-time monitor capable of analyzing the computer application. The real-time monitoring may be implemented, for example, by using a malware analysis environment, such as a virtual machine or emulator environment, located on the user computer and / or server. For example, a malware scanning agent or sensor, such as antivirus software, may be installed / located on the computing device used for malware scanning. In one embodiment of the present invention, a sensor or agent on the computer or server is used to enable intercepting files, system configuration values, and / or network behaviors that are invoked by the application. The sensor may be used to observe the behavior of the device, such as a computer, and the information collected by the sensor may be used to detect malicious behavior of the application, file, and / or process. In one embodiment of the present invention, the real-time monitor requests a sandbox unit to analyze the application. The sandbox unit may monitor or collect the behavior of the application and evaluate them against a set of heuristics, for example, periodically. The sandbox unit may also quarantine the application. After analyzing the application, the results of the analysis (e.g., malicious or non-malicious) may be reported to the real-time monitor. The real-time monitor need not be any separate element or component, but in the solution of the present invention its functionality may be included in the system, the malware analysis environment, and / or the functionality of the user computer and / or server. In one embodiment of the present invention, the functionality of the real-time monitor may be implemented in the user computer or server, for example in anti-malware software.

[0048] In one embodiment of the present invention, the malware scanning environment, service, and / or software can detect the start and end of applications, any abnormal processes, and attach monitoring to the required applications and processes. Also, when the service is started early, it can detect and follow most of the user's applications. In one embodiment of the present invention, when the malware scanning software or service is launched, the malware scanning software or service can perform an inventory of running applications.

[0049] In the solution of the present invention, a sensor and / or malware scanning agent on a computing device, e.g., a user computer or a server, detects that an application is running on a host. In one embodiment of the present invention, in addition to preventing file sharing related threats according to different embodiments of the present invention, a risk rating of the starting application is identified. Based on the identified risk rating of the application, if the risk rating of the application is high, such as exceeding a certain risk rating threshold, and / or if the risk rating of the application is unknown, a snapshot of the device is created. The application can be run after the identification of the risk rating of the application. If the application is determined to be malware when it is running, the application is stopped, the malware is removed, and the changes made to the host are reverted based on said snapshot of the host. In one embodiment of the present invention, the risk rating can be identified by making a request from a server, which can include a malware scanning and risk rating and / or rating database. Data collected using the solution of the present invention can be stored in a database or similar model for information storage for further use.

[0050] In one embodiment, when a malicious file, application, or activity is detected, further actions may be taken to secure the user computer or computer network. Actions may also be taken by modifying the settings of the computer or other network node. Modifying the settings may include, for example, that one or more nodes (which may be computers or other devices) are prevented from being switched off to save information in RAM, a firewall may be switched on at one or more nodes to immediately shut down an attacker, network connectivity of one or more of the network nodes may be slowed or blocked, suspicious files may be removed or quarantined, logs may be collected from the network node, a set of commands may be executed on the network node, users of one or more nodes may be alerted that a threat or anomaly has been detected and their workstations are under investigation, and / or system updates or software patches may be sent from the security backend to the node. In one embodiment of the present invention, one or more of these actions may be initiated automatically.

[0051] Although the present invention has been described above in terms of preferred embodiments, it should be understood that these embodiments are merely illustrative and that the claims are not limited to these embodiments. Those skilled in the art will be able to make modifications and alternatives in light of the disclosure that are considered to be within the scope of the appended claims. Each feature disclosed or exemplified herein may be incorporated into the present invention alone or in any suitable combination with any other feature disclosed or exemplified herein. The list and groups of examples provided in the above description are not exhaustive unless otherwise specified.

Claims

1. 1. A method, e.g., a computer-implemented method, for preventing threats associated with file sharing in a computer or computer network, such as a server (2), comprising: Intercepting file access attempts, such as attempts to modify, create, rename and / or delete files in a monitored location of a computer file system, for example a folder (4) of a server; determining a user identity of a user, such as a remote user, attempting to access the file; Make a backup copy of said file; after creating said backup copy of said file, allowing file access attempts in a monitored location of said computer file system, e.g., a shared folder (4); After the user has terminated access to the file, checking for file corruption; Tracking multiple files accessed in the same user session based on the determined user identity; blocking user access to a computer, such as a server (2), if more than a predetermined number of files with the same user identification are corrupted, and restoring the accessed and / or modified files from said backup copies of said files; method.

2. The method of claim 1 , wherein only files of predefined file types, e.g. compressed file types such as ZIP files, image files such as JPG files, and / or executable files such as EXE files, are checked for file corruption.

3. 3. The method of claim 1 or claim 2, wherein checking for file corruption comprises checking the selected file by parsing the file, for example by parsing a file structure of the file.

4. The method according to any one of claims 1 to 3, wherein checking for file corruption comprises analyzing a file structure based on the type of the file, for example by recognizing it by magic bytes of the file.

5. The method of any one of claims 1 to 4, wherein checking for file corruption after accessing the file comprises comparing the created backup copy with the latest version of the file and / or checking whether either or both of these files are corrupted.

6. The method of any one of claims 1 to 5, wherein checking for file corruption comprises determining the ASCII ratio of the file, for example the ratio of the total number of ASCII characters in the file to the total number of bytes in the file.

7. The method according to any one of claims 1 to 6, further comprising allowing said user access to the server (2) for a predefined period of time without tracking or checking the files accessed by said user if less than a predetermined number of files are corrupted with the same said user identification.

8. The method according to any one of claims 1 to 7, wherein the accessed and / or analyzed files are grouped by user to determine which user sessions are malicious.

9. The method according to any one of claims 1 to 8, wherein a user session is a session including essentially all operations performed by different processes from a process tree or a session including essentially all operations performed by a user per network session.

10. The method according to any one of claims 1 to 9, wherein the user identity is a global user identity (ID) of a server (2) or a service.

11. The method according to any one of the preceding claims, wherein the list of analysed file types and / or file type determination methods is received, for example periodically, from a server (2), such as a back-end server.

12. 1. An arrangement for preventing threats associated with file sharing in a computer or computer network, comprising: The arrangement includes at least one computer, such as a server (2); The computer includes: Intercepting file access attempts, such as attempts to modify, create, rename and / or delete files in a monitored location of a computer file system, for example a folder (4) of a server; determining a user identity of a user, such as a remote user, attempting to access the file; Make a backup copy of said file; after creating said backup copy of said file, allowing file access attempts in a monitored location of said computer file system, e.g., a shared folder (4); After the user has terminated access to the file, checking for file corruption; Tracking multiple files accessed in the same user session based on the determined user identity; blocking user access to a computer, such as a server (2), if more than a predetermined number of files with the same user identification are corrupted, and restoring the accessed and / or modified files from said backup copies of said files; It is configured as follows: composition.

13. Arrangement according to claim 12, arranged to carry out the method according to any one of claims 2 to 11.

14. A computer program comprising instructions which, when executed by a computer, cause the computer to carry out the method according to any one of claims 1 to 11.

15. 15. A computer readable medium comprising a computer program according to claim 14.

Images