Method and system for protecting files from malicious software attacks

Abstract

A method for protecting files from malicious software attacks is described, comprising: providing a plurality of files to be protected (F1-FN); defining (201) the following requests to be verified: file read request (RR), file write request (WR), file delete request (DR); defining (203) the following types of software enablement: software certificate-based (CRT), software hash-based (HSH); software usage history-based (LG); a software agent (AG) reveal (204) by the software agent (AG) a request for operation relating to a file of interest (F1) included in the plurality of files to be protected; the request for operation being issued by a requesting software (REQ-SW; SA, MW)) potentially malicious; verify (206) by the software agent (AG) the presence of at least one of said enabling types (CRT, LG) for the requesting software (REQ-SW); enable (RQ-ES) by the software agent (AG) the execution of the operation request when the presence of at least one of said enabling types has been verified or, otherwise inhibit (RQ-INB) from executing the operation request.

Description

[0001] "Method and system for protecting files from malicious software attacks".

[0002] DESCRIPTION

[0003] FIELD

[0004] The present invention relates to the protection of files from malicious software attacks.

[0005] STATE OF THE ART

[0006] Malicious software (also known as malware) is software that is intentionally designed to cause disturbance to a computer, server, client or computer network. These disruptions may concern, for example, the disclosure of private information, unauthorised access to information or systems, blocking access to information for the user.

[0007] Malware includes ransomware that restricts access to the device it infects, demanding a ransom to be paid to remove the restriction. For instance, some forms of ransomware lock the system and demand the user to pay a ransom to unlock the system, while others encrypt the user's files and demand payment to return the encrypted files to plain text. Other forms of ransomware involve copying sensitive data and threatening to make it public.

[0008] Ransomware is usually spread by e-mail, malware downloads, through vulnerabilities in a device. The means of dissemination are difficult to prevent and pose a huge threat to system users.

[0009] Existing ransomware detection methods are based on the typical behaviour patterns of these viruses.

[0010] The Applicant notes that current ransomware detection requires high computing and storage resources, which can cause slow system execution for devices with low computing power. Furthermore, current ransomware detection must rely on signature libraries and requires the development of detection rules to identify ransomware. If the characteristics and behaviour patterns of a particular ransomware are not present in the developed library, effective detection is not possible.

[0011] Note also that, since some legitimate software may exhibit behaviour similar to ransomware, behaviour-based detection methods may have the drawback of a high false positive rate.

[0012] SUMMARY OF THE INVENTION

[0013] The present invention addresses the problem of providing a method of protecting files accessible from a computer that is suitably efficient and that, as an alternative to the known technique, can dispense with the storage of information necessary for the recognition of malicious software and, in particular, ransomware.

[0014] According to a first aspect, the present invention relates to a method for protecting files as described by claim 1 and preferred embodiments thereof as defined by claims 1-8.

[0015] Also covered by the present invention is a file computer system as described by claim 9 and a particular embodiment thereof as defined by claim 10.

[0016] BRIEF DESCRIPTION OF THE DESIGNS

[0017] The present invention is herein described in detail, by way of example and not limitation, with reference to the accompanying drawings, in which

[0018] - Figure 1 shows schematically a computer system realised in accordance with an example of the present invention;

[0019] - Figure 2 shows a flowchart illustrating an example of a file protection method that can be implemented using such a computer system.

[0020] DETAILED DESCRIPTION

[0021] In this description, similar or identical elements or components will be indicated in the figures with the same identifying symbol.

[0022] Figure 1 shows schematically and in a simplified manner a computer system 100 comprising a first computer 1 and at least a second computer 2 connected by a suitable NTW telecommunications network. For example, the computer system 100 is a corporate network and includes a server computer 3.

[0023] The term computer refers to a programmable automated machine that can perform mathematical calculations or data processing and can also be of a known type. For example, computer 1 and computer 2 can be a personal computer, a server computer, a client computer, a lap top, a tablet and also, a mobile phone, in particular, a smartphone or other devices that include the main components of a computer.

[0024] The first computer 1 comprises a central processing unit CPU (which includes an arithmetic -logic unit ALU and a control unit CU), a central memory CM, a mass memory MM and input-output peripherals IO.

[0025] The first computer 1 is connected via the NTW telecommunications network to the second computer 2, for which the same considerations apply as for the first computer 1.

[0026] The first computer 1 may process to a plurality of Fl-FN files that may reside in the mass storage MM or may reside in computer 2 and which the first computer 1 may access via the NTW telecommunications network. As is well known, the term file in computer science denotes a container of data, typically located in a file system, which in turn is stored on a digital storage medium.

[0027] Files Fl-FN can be of different types and have different extensions (which define their format). For example, as file types we list: document files, compressed files or archives, graphic files, audio files, video files. As examples of file extensions, we list: docx, pptx, xlsx and pdf.

[0028] These files Fl-FN may be processed by a related software SA application installed on computer 1 (which in the case of a mobile phone, may be an 'app') and not malicious. For example, the software SA application may be: word processing software, such as Microsoft's Word; spreadsheet software, such as Microsoft's Excel; presentation software, such as Microsoft's Power Point.

[0029] It is also possible that the first computer 1 may include malicious software MW (also called 'malware') such as, for example, the ransomware described above. The malware MW is such as to access at least some of the files Fl-FN in order to encrypt them, to read (and copy) them and / or to delete them). In this description, the term malicious software also includes any software that attempts an unauthorised copying of a file. Furthermore, it should be noted that the operation of encrypting a file can be defined as a file write operation.

[0030] The first computer 1 is also equipped with an autonomous software agent AG for protecting files Fl-FN which operates, as will be described below, by blocking untrusted read, write and delete file operations. A related software agent similar to the one described herein may advantageously be provided on each computer of the computer system 100 forming, for example, a corporate network.

[0031] As is well known, the fundamental attributes of an autonomous software agent are: agents are not strictly called upon for a task, but activate themselves, agents can reside in a waiting state on a host (such as the first computer 1), sensing the context, agents can switch to the execution state on a host according to start-up conditions, agents do not require user interaction, agents may invoke other tasks, including communication.

[0032] Server computer 3 can be used by an operator both to configure the software agent AG and to define policies that can be invoked and consulted by the software agent AG and under which the agent operates.

[0033] With reference to Figure 2, a method 200 of protecting files (such as Fl- FN) from an attack by malicious software MW such as, for example, ransomware is described. The method 200 is implementable by means of the computer system 100 described above.

[0034] The method 200 described includes certain operations carried out by an operator that can be considered as policy definition steps (which are carried out via the server 3) and other operations that are instead implemented by the software agent AG itself, based on these policies.

[0035] The method 200 comprises a request definition step (DEF) 201 in which a plurality of types of operation requests are defined that are considered to be subject to verification by the software agent AG before being enabled for execution. Such operation requests are: file read request RR, file write request WR and file delete request DR.

[0036] According to an example, the method 200 also includes a step for defining files to be protected 202, in which categories of files are defined for which checks are to be foreseen before authorising one of the request operations RR, WR, DR indicated above. These categories of files to be protected may be defined according to the file typology TP, the file extension EXT, according to a secrecy / security level classification flag CL or according to its content CNT. For example, it is possible to establish that for all files of the audio typology TP and / or that for all files with the extension EXT .pdf, a check is always required before authorising one of the requested operations.

[0037] Method 200 also provides for an initial enabling definition step 203 in which the types of authorisations are defined that are intended to be checked by the software agent AG in order to enable or inhibit an requesting software REQ-SW to perform one of the above-mentioned operations.

[0038] A first type of authorisation is that based on the analysis of a digital certificate CRT associated with the software to be evaluated REQ-SW and that can be easily checked by the software agent AG. Note that in many cases, the company supplying a software application also provides a digital certificate attesting to its authenticity. An operator, via server 3, can choose from a list of software (e.g. a list of applications already provided by server 3) for which verification of the relevant certificate CRT is required. In the event that a specific software certificate is not available in the list provided by server 3, it is also possible to provide that for certain software applications, the certificate CRT can be entered manually by the operator. For example, an operator may autonomously add other certificates in addition to the one already available from server 3.

[0039] A second type of authorisation is associated with the hash HSH of the software to be evaluated REQ-SW (which may be an executable program). An operator, via server 3, can create and make available a second list of applications for which this type of verification is required.

[0040] A third type of authorisation is based on a historical analysis LG of software use. In this case, on the basis of a sequential and chronological record (the log file) of the operations carried out by the first computer 1, it is established that for those software applications that are used more frequently and / or more recently, according to certain parameters, the authorisation is granted. Conversely, authorisation is not granted for those software applications that have a history of use that does not fall within the aforementioned parameters. Here too, a third list is made available (e.g. from server 3) indicating the software for which authorisation may not be granted on the basis of historical analysis.

[0041] It should be noted that the lists with information on the software to be evaluated according to the above-mentioned three types of authorisation can advantageously be updated periodically.

[0042] In the operation part, the method 200 comprises a detection step 204 in which the software agent AG detects a transaction request that belongs to one of the three types described above and is generated by a requesting software REQ-SW and relates to a file of interest Fl. For example, a write request WR of the file of interest Fl is detected.

[0043] The software agent AG may, for example, check (control step 205, CONTR) whether the file of interest Fl is a file that belongs to a category of files to be protected as defined in step 202, and then evaluate it according to the file typology TP, the file extension EXT, the presence of a secrecy / security level classification CL, or according to its content CNT.

[0044] In the event that the file Fldoes not fall among the files to be protected as a result of the control step 205, the software agent AG does not interfere with the requested write activity, which is then carried out regularly (requested execution step RQ-ES in Figure 2).

[0045] If this is not the case, method 200 continues with an authorisation verification step 206 (AB-VER) in which the software agent AG analyses the requesting software REQ-SW and verifies whether at least one authorisation defined in step 203 can be granted for it.

[0046] In particular, in the authorisation verification step 206, the software agent AG checks whether the requesting software REQ-SW has a certificate CRT (which is issued by the producing company or by a system administrator) among those in the first list that the agent has or can recall.

[0047] Upon successful verification of the certificate CRT conferring authenticity on the requesting software REQ-SW, the write request WR of the file Flis enabled: request execution step RQ-ES of Figure 2.

[0048] In the event of a negative outcome of this verification with regard to the certificate CRT, the software agent AG shall evaluate the hash HSH of the requesting software REQ-SW, using the information contained in the second list and in relation to those hashes.

[0049] If the result is positive, method 200 moves on to the request execution step RQ-ES. If not, it is checked whether the requesting software REQ-SW can be enabled based on a historical analysis LG of its use. If this second check is passed, the write request WR is enabled (request execution step RQ-ES).

[0050] Otherwise, i.e. when none of the three checks have been successful, the write request WR is inhibited (request inhibition step RQ-INB) because the requesting software REQ-SW has been assessed to be malware and is therefore prevented from acting on the file Flof interest, blocking its action.

[0051] It should be noted that it is also possible to envisage a different order of verification of the three types of authorisations 206 than that described above, i.e., for example, first to carry out the verification relating to the authorisation based on a historical analysis LG and, in the event of a negative outcome, to move on to that relating to the certificate CRT and then to that relating to the hash HSH. It is also possible to provide for only one or only two of these three verifications.

[0052] The above description of method 200, which referred to the write request of a file as an example, is also valid for read RR and delete DR operations of the file.

[0053] It should also be noted that in the event that the software agent AG inhibits a requested RR, WR or DR operation by a regular user of computer system 100, via a non-malicious application, this user may contact an operator who, for example via server 3, enables the requested operation.

[0054] Advantageously, it is also possible to perform a monitoring operation of the entire computer system 100 comprising several computers equipped with a file protection software agent such as the one AG described. Such monitoring, which can be carried out by appropriate software that can be managed by a peripheral of the system 100, provides access to information about the activities of the various software agents AG and obtains, for example, the number and specifics of malicious activities identified by the software agents. It should be noted that the protection method 200 described has the advantage of blocking malware activity from the outset and, in the case of ransomware, rendering any blackmail action unsuccessful.

[0055] Moreover, the method described does not involve the need to catalogue, with frequent updates, a large number of malware (in particular, ransomware) on the computer of interest in order to be able to identify them. In fact, as is clear from the description above, method 200 is not based on an investigation aimed at recognising any particular malware, but is based on a check of particular properties of the software that requires a certain operation to be performed on a file.

[0056] Another advantage of the method described is the fact that the software agent does not interfere with or delay the work of the user of the computer concerned.

[0057] Legend of figure symbols computer system 100 first computer 1 second computer 2 computer server 3 telecommunications network NTW central processing unit CPU arithmetic-logic unit ALU control unit CU central memory CM mass storage MM input-output peripherals IO multiple Fl-FN files file of interest Fl software application SA malicious software MW software agent AG file protection method 200 request definition step 201 (DEF) file read request RR, file write request WR file deletion request DR step of definition of files to be protected 202

[0058] TP file type

[0059] EXT file extension security classification CL content of the file CNT applicant software REQ-SW qualification definition step 203 digital certificate CRT hash HSH historical analysis use of the software LG request disclosure step 204 control step 205 (CONTR) requested execution step RQ-ES qualification verification step 206 (AB-VER) request inhibition step RQ-INB

Claims

CLAIMS1. Method (200) of protecting files from malicious software attacks, including: providing a plurality of files to be protected (Fl-FN) and accessible via a computer (1); defining (201) the following requests to be verified: file read request (RR), file write request (WR), file delete request (DR); defining (203) the following types of software enablement: software certificate-based (CRT) enablement; software hash-based (HSH) enablement; software historical usage analysis (LG) enablement; providing a software agent (AG) executable on that computer (1); detecting (204) by the software agent (AG) an operation request of a type belonging to the requests to be verified (RR, WR, DR) and relating to a file of interest (Fl) included in the plurality of files to be protected; the operation request being issued by a potentially malicious requesting software (REQ-SW; SA, MW)) operating on the computer (1); verifying (206) by the software agent (AG) the presence of at least one of the above-mentioned types of authorisation (CRT, LG) for the requesting software (REQ-SW); enabling (RQ-ES) by the software agent (AG) the execution of the operation request when at least one of the above-mentioned types of enablement is present; inhibiting (RQ-INB) by the software agent (AG) the execution of the operation request when at least one of the above-mentioned types ofenablement is not present.

2. Method (200) according to claim 1, further comprising: when at least one of the above-mentioned types of authorisation types is not present, defining the requesting software (REQ-SW) by the software agent (AG) as malicious software (MW).

3. Method (200) according to claim 1, wherein said software agent (AG) operates at the level of the computer operating system (1).

4. Method (200) according to claim 1, wherein said plurality of files (Fl- FN) comprises: files resident on computer (1), files resident on another computer (2) connected to said computer by a computer network (NTW).

5. Method (200) according to claim 1, wherein said file certificate (CRT) is one of the following types: digital certificate associated with the file by the producer of an application for generating the file; digital certificate issued by an operator.

6. Method (200) claim 1, further comprising: defining said files to be protected (202) according to at least one of the following modalities: file type (TP), file extension (EXT), file secrecy / security level classification (CL), file content (CNT).

7. Method (200) according to claim 1, wherein defining the software historical usage analysis (LG) enablement comprises selecting files used by a computer user within a predetermined past time interval and evaluating the frequency of use of said selected file.

8. Method according to claim 1, wherein said malicious software is a ransomware.

9. Computer system (100) comprising:a computer (1) comprising: a plurality of files to be protected (Fl-FN) stored in a memory of said computer and a software agent (AG) configured in such a way as to define (201) the following requests to be checked: file read request (RR), file write request (WR), file delete request (DR); define (203) the following types of software enablement: software certificate-based (CRT) enablement; software hash-based (HSH) enablement; software historical usage analysis (LG) enablement; detect (204) by the software agent (AG) an operation request of a type belonging to the requests to be verified (R, WR, DR) and relating to a file of interest (Fl) included in the plurality of files to be protected; the operation request being issued by a potentially malicious requesting software (REQ-SW; SA; MW)) operating on the computer; verify (206) by the software agent (AG) the presence of at least one of the above-mentioned types of authorisation (CRT, LG) for the requesting software (REQ-SW); enable (RQ-ES) by the software agent (AG) the execution of the operation request when at least one ofsaid types of enablement is present; inhibit (RQ-INB) by the software agent (AG) the execution of the operation request when at least one of the above-mentioned types of enablement is not present.

10. System (100) according to claim 9, further comprising: a plurality of computers (2) connected via a network (NTW) to said computer (1); each computer of the plurality being equipped with an additional software agent (AG) configured as said software agent (AG);in which: the computer system (100) includes a monitoring software configured to exchange data with the computer (1) and the further computers (2) to gather information about the activity of the software agent (AG) and the further software agents.

Images