Non-disruptive fast ransomware prevention

Abstract

In some examples, a method for preventing spread of malware by regulating read and write access to data in a cache of an apparatus, comprises associating a first process identifier for a first process with the data in the cache, wherein the first process is provided with unmitigated read and / or write access to the data in the cache, regulating access to the data in the cache by a second process, whereby to prevent read and write access to the data in the cache by the second process whilst the first process has read and / or write access to the data in the cache, determining, before or during flushing the data in the cache to a storage of the apparatus, whether the data in the cache has been modified by the first process, on the basis of the determination, determining the potential presence of malware in the data in the cache, and allowing access to the data in the cache by the second process in the event that the potential presence of malware is not determined.

Description

[0001] NON-DISRUPTIVE FAST RANSOMWARE PREVENTION

[0002] TECHNICAL FIELD

[0003] The present disclosure relates, in general, to preventing the spread of malware by regulating read and write access to data in a cache.

[0004] BACKGROUND

[0005] Malware, or “malicious software,” comprises any malicious program, application or code that may be harmful to systems. Ransomware is a type of malware that prevents users from accessing their system or personal files unless a ransom payment is made in order to regain access.

[0006] Ransomware is increasingly becoming a large threat for organizations of any size. For example, applications used by organisations typically have large data dependencies. For example, applications that utilise databases often write user data to multiple locations, such as journals, replicas, and so on. Regardless of whether a centralized or decentralized storage mechanism is used for data, it may be exposed to encryption by ransomware applications.

[0007] Ransomware prevention techniques typically rely on file entropy calculation, dynamic runtime reconfiguration (DRR) change measurements, and working with 3rd party ransomwaredetectors. However, when performed in the foreground, these solutions impose system performance reductions as they may be computationally intensive and can interrupt or affect other processes (e.g., by blocking write operations). Conversely, when performed in the background, such solutions are typically unable to detect and immediately prevent ransomware from occurring, which can lead to corrupted data being spread in unpredictable ways.

[0008] There is therefore a trade-off between effectiveness, leading to performance issues and maintaining performance at the cost of decreased detection and / or prevention proficiency. SUMMARY

[0009] An objective of the present disclosure is to provide a method of testing for suspicious activity in relation to read and / or write operations to data when actual changes to the data are de-staged to a storage device, thereby enabling processes to write without interruption.

[0010] The foregoing and other objectives are achieved by the features of the independent claims.

[0011] Further implementation forms are apparent from the dependent claims, the description and the Figures.

[0012] A first aspect of the present disclosure provides a method for preventing spread of malware by regulating read and write access to data in a cache of an apparatus, the method comprising associating a first process identifier for a first process with the data in the cache, wherein the first process is provided with unmitigated read and / or write access to the data in the cache, regulating access to the data in the cache by a second process, whereby to prevent read and write access to the data in the cache by the second process whilst the first process has read and / or write access to the data in the cache, determining, before or during flushing the data in the cache to a storage of the apparatus, whether the data in the cache has been modified by the first process, on the basis of the determination, determining the potential presence of malware in the data in the cache, and allowing access to the data in the cache by the second process in the event that the potential presence of malware is not determined.

[0013] Accordingly, a first process can be provided with full access to a file and not experience any interruptions as a result of, e.g., a malware detection system scanning data for the file. Access to the file, or associated data, can be blocked or regulated, such that another process is not provided with read and / or write access to the data, until the data has been flushed from the cache of the apparatus (such as when the first process has finished using the data for example).

[0014] In an implementation of the first aspect, the method can further comprise disassociating the first process identifier of the first process with the data in the cache, associating a second process identifier for the second process with the data in the cache, and providing the second process with unmitigated read and / or write access to the data in the cache.

[0015] As such, a second process, which has initially been blocked from accessing the data in the cache, can be effectively linked to the data (by way of a suitable process identifier for example), thereby enabling the second process access to the data. In an example, the data in the cache can be compared with a version of the data in the storage of the apparatus to determine the potential presence of malware in the data in the cache. For example, an entropy difference calculation can be performed in order to determine a change in entropy between the data in the cache and a version of the data in the storage of the apparatus.

[0016] The method can further comprise determining whether the data in the cache comprises a new cache page, and on the basis of the determination, associating the first process identifier for the first process with the data in the cache. The method can further comprise determining whether the data in the cache comprises an existing cache page, determining a process identifier of a process associated with the data in the cache, and on the basis of the determination, providing the determined process with unmitigated read and / or write access to the data in the cache, or blocking access to the data in the cache.

[0017] A second aspect of the present disclosure provides an apparatus comprising a processor, and a memory coupled to the processor, the memory comprising instructions for preventing spread of malware by regulating read and write access to data in a cache of the apparatus and which, when executed by the processor, cause the apparatus to associate a first process identifier for a first process with the data in the cache, wherein the first process is provided with unmitigated read and / or write access to the data in the cache, regulate access to the data in the cache by a second process, whereby to prevent read and write access to the data in the cache by the second process whilst the first process has read and / or write access to the data in the cache, determine, before or during flushing the data in the cache to a storage of the apparatus, whether the data in the cache has been modified by the first process, on the basis of the determination, determine the potential presence of malware in the data in the cache, and enable access to the data in the cache by the second process in the event that the potential presence of malware is not determined.

[0018] In an implementation of the second aspect, the instructions, when executed by the processor, can cause the apparatus to disassociate the first process identifier of the first process with the data in the cache, associate a second process identifier for the second process with the data in the cache, and provide the second process with unmitigated read and / or write access to the data in the cache. The instructions, when executed by the processor, can cause the apparatus to compare the data in the cache with a version of the data in the storage of the apparatus to determine the potential presence of malware in the data in the cache. The instructions, when executed by the processor, can cause the apparatus to calculate a difference in entropy between the data in the cache and a version of the data in the storage of the apparatus, and on the basis of the difference in entropy, determine the potential presence of malware. The instructions, when executed by the processor, can cause the apparatus to determine whether the data in the cache comprises a new cache page, and on the basis of the determination, associate the first process identifier for the first process with the data in the cache. The instructions, when executed by the processor, can cause the apparatus to determine whether the data in the cache comprises an existing cache page, determine a process identifier of a process associated with the data in the cache, and on the basis of the determination, provide the determined process with unmitigated read and / or write access to the data in the cache, or blocking access to the data in the cache.

[0019] A third aspect of the present disclosure provides a machine-readable storage medium comprising instructions for preventing spread of malware by regulating read and write access to data in a cache of an apparatus, the instructions executable by a processor of the apparatus, whereby to cause the processor to associate a first process identifier for a first process with the data in the cache, wherein the first process is provided with unmitigated read and / or write access to the data in the cache, regulate access to the data in the cache by a second process, whereby to prevent read and write access to the data in the cache by the second process whilst the first process has read and / or write access to the data in the cache, determine, before or during flushing the data in the cache to a storage of the apparatus, whether the data in the cache has been modified by the first process, on the basis of the determination, determine the potential presence of malware in the data in the cache, and enable access to the data in the cache by the second process in the event that the potential presence of malware is not determined.

[0020] In an implementation of the third aspect, the machine-readable storage medium can further comprise instructions executable by the processor, whereby to cause the processor to determine whether the data in the cache comprises a new cache page, and on the basis of the determination, associate the first process identifier for the first process with the data in the cache. The machine- readable storage medium can further comprising instructions executable by the processor, whereby to cause the processor to determine whether the data in the cache comprises an existing cache page, determine a process identifier of a process associated with the data in the cache, and on the basis of the determination, provide the determined process with unmitigated read and / or write access to the data in the cache, or blocking access to the data in the cache. These and other aspects of the invention will be apparent from the embodiment s) described below.

[0021] BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order that the present disclosure may be more readily understood, embodiments will now be described, by way of example, with reference to the accompanying drawings, in which:

[0023] Figure l is a schematic representation of aa apparatus, according to an example;

[0024] Figure 2 is a schematic representation of aa apparatus, according to an example;

[0025] Figure 3 is a flowchart of a method, according to an example; and

[0026] Figure 4 is a flowchart of a method, according to an example.

[0027] DETAILED DESCRIPTION

[0028] Example embodiments are described below in sufficient detail to enable those of ordinary skill in the art to embody and implement the systems and processes herein described. It is important to understand that embodiments can be provided in many alternate forms and should not be construed as limited to the examples set forth herein.

[0029] Accordingly, while embodiments can be modified in various ways and take on various alternative forms, specific embodiments thereof are shown in the drawings and described in detail below as examples. There is no intent to limit to the particular forms disclosed. On the contrary, all modifications, equivalents, and alternatives falling within the scope of the appended claims should be included. Elements of the example embodiments are consistently denoted by the same reference numerals throughout the drawings and detailed description where appropriate.

[0030] The terminology used herein to describe embodiments is not intended to limit the scope. The articles “a,” “an,” and “the” are singular in that they have a single referent, however the use of the singular form in the present document should not preclude the presence of more than one referent. In other words, elements referred to in the singular can number one or more, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises,” “comprising,” “includes,” and / or “including,” when used herein, specify the presence of stated features, items, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, items, steps, operations, elements, components, and / or groups thereof. The term “and / or” is only an association relationship for describing associated objects and represents that three relationships may exist such that A and / or B may indicate that A exists alone, A and B exist at the same time, or B exists alone. The character “ / ” generally represents that the associated objects are in an “or” relationship.

[0031] Unless otherwise defined, all terms (including technical and scientific terms) used herein are to be interpreted as is customary in the art. It will be further understood that terms in common usage should also be interpreted as is customary in the relevant art and not in an idealized or overly formal sense unless expressly so defined herein.

[0032] The following contains specific information related to implementations of the present disclosure. The drawings and their accompanying detailed disclosure are merely directed to implementations. However, the present disclosure is not limited to these implementations. Other variations and implementations of the present disclosure will be obvious to those skilled in the art.

[0033] The phrases “in one implementation,” or “in some implementations,” may each refer to one or more of the same or different implementations. The term “coupled” is defined as connected whether directly or indirectly through intervening components and is not necessarily limited to physical connections. The expression “at least one of A, B and C” or “at least one of the following: A, B and C” means “only A, or only B, or only C, or any combination of A, B and C.”

[0034] The terms “system” and “network” may be used interchangeably.

[0035] For the purposes of explanation and non-limitation, specific details such as functional entities, techniques, protocols, and standards are set forth for providing an understanding of the present disclosure. In other examples, detailed disclosure of well-known methods, technologies, systems, and architectures are omitted so as not to obscure the present disclosure with unnecessary details. Persons skilled in the art will immediately recognize that any network fimction(s) or algorithm(s) disclosed may be implemented by hardware, software or a combination of software and hardware. Disclosed functions may correspond to modules which may be software, hardware, firmware, or any combination thereof.

[0036] A software implementation may include machine- and / or computer- readable and / or executable instructions stored on a machine- and / or computer-readable medium such as memory or other types of storage devices. One or more microprocessors or general-purpose computers with communication processing capability may be programmed with corresponding executable instructions and perform the disclosed network function(s) or algorithm(s).

[0037] The microprocessors or general-purpose computers may include Applications Specific Integrated Circuitry (ASIC), programmable logic arrays, and / or using one or more Digital Signal Processor (DSPs). Although some of the disclosed implementations are oriented to software installed and executing on computer hardware, alternative implementations implemented as firmware or as hardware or as a combination of hardware and software are well within the scope of the present disclosure. The computer readable medium includes but is not limited to Random Access Memory (RAM), Read Only Memory (ROM), Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), flash memory, Compact Disc Read-Only Memory (CD-ROM), magnetic cassettes, magnetic tape, magnetic disk storage, or any other equivalent medium capable of storing computer-readable instructions.

[0038] When potential malware, such as ransomware, is detected by a malware detection system, the typical response is to halt or block all write operations. For example, suspect write operations that may be related to encryption of a file by ransomware, and which can be detected inline (i.e., on the fly) by, e.g., entropy calculations for the file in question, will result in write operations being blocked so that manual intervention can take place to determine whether a valid detection event has occurred. This presents a significant performance impact.

[0039] According to an example, there is provided a non-disruptive ransomware prevention system. In an implementation, testing for potential suspicious activity can be performed when actual data / file changes are de-staged to a storage (such as a disk), whilst allowing applications to write without interruption. Such a system can be implemented for use with, e.g., virtual machines or the like, and / or primary and / or secondary and / or backup storage systems that require ransomware protection.

[0040] Figure l is a schematic representation of an apparatus according to an example. The apparatus 100 comprises a processor 103, and a memory 105 coupled to the processor 103. The memory 105 comprises instructions 107. The instructions 107 can comprise instructions for preventing spread of malware by regulating read and write access to data in a cache 150 of the apparatus 100. For example, the instructions 107 can implement a malware detection system for the apparatus 100.

[0041] In the example of figure 1, a first process 151 executing on or for the apparatus 100 accesses data in the cache 150 representing a file 153. According to an example, file 153 is therefore marked as owned by the first process 151. For example, a first process identifier can be associated, for the first process 151, with the data 153 in the cache 150. The first process 151 is provided with unmitigated read and / or write access to the data 153 in the cache 150. For example, read and / or write operations 152 associated with the first process can be served immediately (i.e., there is no read / write blocking). However, access to the data 153 in the cache 150 by a second process 155 is regulated, whereby to prevent read and write access 157 to the data 153 in the cache 150 by the second process 155 whilst the first process 151 has read and / or write access to the data 153 in the cache 150. Accordingly, read and write operations performed by the second process 155 in respect of the data 153 are blocked.

[0042] According to an example, a background task 159 can flush OS-cached data to a disk 160 of the apparatus. That is, data 153 currently ‘owned’ by the first process can be flushed 159 to the disk 160 to form file 161. In an example, as the data 153 is flushed from the cache 150 it can be tested for malware, such as ransomware. Accordingly, read and / or write operations 152 by the first process 151 remain unhindered, and it is only when data 153 is flushed to the disk 160 that a malware detection process is implemented. Once the data 153 is flushed from the cache 150, the second process 155 can be unblocked. That is, read and / or write access to the data 153 can be provided to the second process 155.

[0043] According to an example, a process identifier, such as a first process identifier for example can be added to the dirty page cache of the apparatus 100. Dirty means that the data is stored in the cache 150 but needs to be written to the underlying storage device (e.g., disk 160) first. That is, pages that have been modified are marked as "dirty" and have to be flushed to disk 160 before they can be freed. The content of these dirty pages is thus periodically transferred by flushing to the underlying storage device. Typically, this indication should exist already, and comprises an indication of which process (process identifier - PID) last wrote to it. In an example, a list of pending writes and their corresponding PID to an operating system (of the apparatus 100) dirty page cache can be maintained (again, this should usually exist already).

[0044] According to an example, upon flushing, if the file is not new (overwrite occurred), a foreground ransomware protection (FRD) system can read the older version of the page on disk 160 and check for suspicious activity. This can be done by performing an entropy difference calculation between the data present in the in-memory dirty buffer and the data in the on-disk buffer. Other methods include verifying the file format (e.g., docx, jpg and other files that have known structures), pulling the new revision to a sandbox environment and checking whether the change makes sense (e.g., loading a PDF file change with PDF reader software, taking a screenshot and running OCR software to recognize text), and so on. In an example, the flush flow can be optimised by eliminating the read-amplification required for, e.g., entropy difference calculations. An in-memory data structure (such as Bloomfilter, for example) can be maintained in order to hint, with a high probability, whether file entropy should be high or not (e.g., a user might have intended to write high-entropy data such as compressed or encrypted data).

[0045] If suspicious activity has been identified, the FRD system can alert a user that a ransomware might have been found and submit the file 161 for deeper inspection. Otherwise, if the next pending I / O to the file relates to a different owner (e.g., the second process 155) read / write access can be unblocked and the owner can be changed using the corresponding PID.

[0046] According to an example, read / write access can be performed on an OS-cached page loaded from a file. If this is a new cache page (i.e., first access / first access after being evicted from the cache etc.) the owner can be set to the accessing process’ PID and I / O can be immediately served. Alternatively, if it is an existing cache page and the accessing process’ PID is the same as the owner, the I / O can be served immediately. Otherwise, (i.e., the owner is different), access can be blocked.

[0047] Figure 2 is a schematic representation of an apparatus according to an example. The apparatus 200 of figure 2 is the same as that of figure 1. The difference between the two is that, in the example of figure 2, foreground ransomware detection 201 is performed before data 153 is flushed to disk 160.

[0048] Figure 3 is a flowchart of a method according to an example. In the example of figure 3, the flowchart relates to the implementation of a method for preventing spread of malware by regulating read and write access to data 153 in a cache 150 of an apparatus (such as apparatus 100 or 200 as described with reference to figures 1 or 2 for example). In block 301, a first process identifier for a first process 151 is associated with the data 153 in the cache 150, wherein the first process 151 is provided with unmitigated read and / or write access 152 to the data 153 in the cache 150.

[0049] In block 303, access to the data 153 in the cache 150 by a second process 155 is regulated 157, whereby to prevent read and write access to the data 153 in the cache 150 by the second process 155 whilst the first process 151 has read and / or write access 152 to the data 153 in the cache 150.

[0050] In block 305, it is determined, before or during flushing 159 the data 153 in the cache 150 to a storage 160 of the apparatus (100; 200), whether the data 153 in the cache 150 has been modified by the first process 151.

[0051] In block 307, on the basis of the determination in block 305, the potential presence of malware in the data 153 in the cache 150 is determined. For example, a malware detection system can be used to scan the data 153 either before (refer to figure 2) or as (refer to figure 1) the data 153 is flushed to the disk 160.

[0052] In block 309, access to the data 153 in the cache 150 is allowed by the second process 155 in the event that the potential presence of malware is not determined.

[0053] Figure 4 is a flowchart of a method according to an example. In block 401, the first process identifier of the first process is disassociated with the data in the cache. For example, once data 153 has been flushed to disk 160 and the first process 151 is no longer accessing the data 153, the ‘owner’ of the data - being the first process in this example - can be removed (or disassociated), whereby to enable another process (such as the second process 155 for example) to have access to the data 153. Accordingly, in block 403, a second process identifier for the second process 155 can be associated with the data 153 in the cache 150. As such, in block 405, the second process 155 can be provided with unmitigated read and / or write access to the data 153 in the cache 150.

[0054] Examples in the present disclosure can be provided as methods, systems or machine-readable instructions, such as any combination of software, hardware, firmware or the like. Such machine-readable instructions may be included on a computer readable storage medium (including but not limited to disc storage, CD-ROM, optical storage, etc.) having computer readable program codes therein or thereon.

[0055] The present disclosure is described with reference to flow charts and / or block diagrams of the method, devices and systems according to examples of the present disclosure. Although the flow diagrams described above show a specific order of execution, the order of execution may differ from that which is depicted. Blocks described in relation to one flow chart may be combined with those of another flow chart. In some examples, some blocks of the flow diagrams may not be necessary and / or additional blocks may be added. It shall be understood that each flow and / or block in the flow charts and / or block diagrams, as well as combinations of the flows and / or diagrams in the flow charts and / or block diagrams can be realized by machine readable instructions.

[0056] The machine-readable instructions may, for example, be executed by a machine such as a general-purpose computer, a network apparatus, a platform comprising user equipment such as a smart device, e.g., a smart phone, a special purpose computer, an embedded processor or processors of other programmable data processing devices to realize the functions described in the description and diagrams. In particular, a processor or processing apparatus may execute the machine-readable instructions. Thus, modules of apparatus (for example, a module implementing a malware detection system, a process and so on) may be implemented by a processor executing machine readable instructions stored in a memory, or a processor operating in accordance with instructions embedded in logic circuitry. The term 'processor' is to be interpreted broadly to include a CPU, processing unit, ASIC, logic unit, or programmable gate set etc. The methods and modules may all be performed by a single processor or divided amongst several processors.

[0057] Such machine-readable instructions may also be stored in a computer readable storage that can guide the computer or other programmable data processing devices to operate in a specific mode. For example, the instructions may be provided on a non-transitory computer readable storage medium encoded with instructions, executable by a processor.

[0058] In an implementation a machine can comprise, e.g., a system or apparatus, user equipment, a network apparatus (or part thereof). As described above with reference to figures 1 to 4 for example, a machine or apparatus can comprise a processor 103, and a memory 105 to store instructions 107, executable by the processor 103. The machine can comprise a storage 160 that can be used to store data such as a file 161 that comprises data flushed from a cache 150 of the apparatus (100; 200).

[0059] The instructions 107, executable by the processor 103, can cause the apparatus of any of figures 1 or 2 to associate a first process identifier for a first process with the data in the cache, wherein the first process is provided with unmitigated read and / or write access to the data in the cache, regulate access to the data in the cache by a second process, whereby to prevent read and write access to the data in the cache by the second process whilst the first process has read and / or write access to the data in the cache, determine, before or during flushing the data in the cache to a storage of the apparatus, whether the data in the cache has been modified by the first process, on the basis of the determination, determine the potential presence of malware in the data in the cache, and enable access to the data in the cache by the second process in the event that the potential presence of malware is not determined.

[0060] Accordingly, the machine or apparatus 100; 200 can implement a method for preventing spread of malware by regulating read and write access to data in a cache of an apparatus.

[0061] Such machine-readable instructions may also be loaded onto a computer or other programmable data processing devices, so that the computer or other programmable data processing devices perform a series of operations to produce computer-implemented processing, thus the instructions executed on the computer or other programmable devices provide an operation for realizing functions specified by flow(s) in the flow charts and / or block(s) in the block diagrams.

[0062] Further, the teachings herein may be implemented in the form of a computer or software product, such as a non-transitory machine-readable storage medium, the computer software or product being stored in a storage medium and comprising a plurality of instructions, e.g., machine readable instructions, for making a computer device implement the methods recited in the examples of the present disclosure. In some examples, some methods can be performed in a cloud-computing or network-based environment. Cloud-computing environments may provide various services and applications via the Internet. These cloud-based services (e.g., software as a service, platform as a service, infrastructure as a service, etc.) may be accessible through a web browser or other remote interface of the user equipment for example. Various functions described herein may be provided through a remote desktop environment or any other cloud-based computing environment.

[0063] While various embodiments have been described and / or illustrated herein in the context of fully functional computing systems, one or more of these exemplary embodiments may be distributed as a program product in a variety of forms, regardless of the particular type of computer- readable-storage media used to actually carry out the distribution. The embodiments disclosed herein may also be implemented using software modules that perform certain tasks. These software modules may include script, batch, or other executable files that may be stored on a computer-readable storage medium or in a computing system. In some embodiments, these software modules may configure a computing system to perform one or more of the exemplary embodiments disclosed herein. In addition, one or more of the modules described herein may transform data, physical devices, and / or representations of physical devices from one form to another.

[0064] The preceding description has been provided to enable others skilled in the art to best utilize various aspects of the exemplary embodiments disclosed herein. This exemplary description is not intended to be exhaustive or to be limited to any precise form disclosed. Many modifications and variations are possible without departing from the spirit and scope of the instant disclosure. The embodiments disclosed herein should be considered in all respects illustrative and not restrictive. Reference should be made to the appended claims and their equivalents in determining the scope of the instant disclosure.

Claims

CLAIMS1. A method for preventing spread of malware by regulating read and write access to data in a cache of an apparatus, the method comprising: associating a first process identifier for a first process with the data in the cache, wherein the first process is provided with unmitigated read and / or write access to the data in the cache; regulating access to the data in the cache by a second process, whereby to prevent read and write access to the data in the cache by the second process whilst the first process has read and / or write access to the data in the cache; determining, before or during flushing the data in the cache to a storage of the apparatus, whether the data in the cache has been modified by the first process; on the basis of the determination, determining the potential presence of malware in the data in the cache; and allowing access to the data in the cache by the second process in the event that the potential presence of malware is not determined.

2. The method as claimed in claim 1, further comprising: disassociating the first process identifier of the first process with the data in the cache; associating a second process identifier for the second process with the data in the cache; and providing the second process with unmitigated read and / or write access to the data in the cache.

3. The method as claimed in claim 1 or 2, further comprising: comparing the data in the cache with a version of the data in the storage of the apparatus to determine the potential presence of malware in the data in the cache.

4. The method as claimed in any preceding claim, further comprising: performing an entropy difference calculation to determine a change in entropy between the data in the cache and a version of the data in the storage of the apparatus.

5. The method as claimed in any preceding claim, further comprising: determining whether the data in the cache comprises a new cache page; and on the basis of the determination, associating the first process identifier for the first process with the data in the cache.

6. The method as claimed in any preceding claim, further comprising: determining whether the data in the cache comprises an existing cache page; determining a process identifier of a process associated with the data in the cache; and on the basis of the determination, providing the determined process with unmitigated read and / or write access to the data in the cache, or blocking access to the data in the cache.

7. An apparatus comprising a processor, and a memory coupled to the processor, the memory comprising instructions for preventing spread of malware by regulating read and write access to data in a cache of the apparatus and which, when executed by the processor, cause the apparatus to: associate a first process identifier for a first process with the data in the cache, wherein the first process is provided with unmitigated read and / or write access to the data in the cache; regulate access to the data in the cache by a second process, whereby to prevent read and write access to the data in the cache by the second process whilst the first process has read and / or write access to the data in the cache; determine, before or during flushing the data in the cache to a storage of the apparatus, whether the data in the cache has been modified by the first process;on the basis of the determination, determine the potential presence of malware in the data in the cache; and enable access to the data in the cache by the second process in the event that the potential presence of malware is not determined.

8. The apparatus as claimed in claim 7, wherein the instructions, when executed by the processor, cause the apparatus to: disassociate the first process identifier of the first process with the data in the cache; associate a second process identifier for the second process with the data in the cache; and provide the second process with unmitigated read and / or write access to the data in the cache.

9. The apparatus as claimed in claim 7 or 8, wherein the instructions, when executed by the processor, cause the apparatus to: compare the data in the cache with a version of the data in the storage of the apparatus to determine the potential presence of malware in the data in the cache.

10. The apparatus as claimed in any of claims 7 to 9, wherein the instructions, when executed by the processor, cause the apparatus to: calculate a difference in entropy between the data in the cache and a version of the data in the storage of the apparatus; and on the basis of the difference in entropy, determine the potential presence of malware.

11. The apparatus as claimed in any of claims 7 to 10, wherein the instructions, when executed by the processor, cause the apparatus to: determine whether the data in the cache comprises a new cache page; andon the basis of the determination, associate the first process identifier for the first process with the data in the cache.

12. The apparatus as claimed in any of claims 7 to 11, wherein the instructions, when executed by the processor, cause the apparatus to: determine whether the data in the cache comprises an existing cache page; determine a process identifier of a process associated with the data in the cache; and on the basis of the determination, provide the determined process with unmitigated read and / or write access to the data in the cache, or blocking access to the data in the cache.

13. A machine-readable storage medium comprising instructions for preventing spread of malware by regulating read and write access to data in a cache of an apparatus, the instructions executable by a processor of the apparatus, whereby to cause the processor to: associate a first process identifier for a first process with the data in the cache, wherein the first process is provided with unmitigated read and / or write access to the data in the cache; regulate access to the data in the cache by a second process, whereby to prevent read and write access to the data in the cache by the second process whilst the first process has read and / or write access to the data in the cache; determine, before or during flushing the data in the cache to a storage of the apparatus, whether the data in the cache has been modified by the first process; on the basis of the determination, determine the potential presence of malware in the data in the cache; and enable access to the data in the cache by the second process in the event that the potential presence of malware is not determined.

14. The machine-readable storage medium as claimed in claim 13, further comprising instructions executable by the processor, whereby to cause the processor to: determine whether the data in the cache comprises a new cache page; and on the basis of the determination, associate the first process identifier for the first process with the data in the cache.

15. The machine-readable storage medium as claimed in claim 13 or 14, further comprising instructions executable by the processor, whereby to cause the processor to: determine whether the data in the cache comprises an existing cache page; determine a process identifier of a process associated with the data in the cache; and on the basis of the determination, provide the determined process with unmitigated read and / or write access to the data in the cache, or blocking access to the data in the cache.

Images