Method and system for delaying software gaining access to data

Abstract

A computer-implemented method of delaying software gaining access to data, the method comprising the steps: receiving a data access request from the software (104); in response to the data access request: generating simulated virtual data by simulating a data structure (108); and outputting the simulated virtual data to the software (110), wherein the simulated virtual data is configured to violate at least one data access protocol.

Description

[0001] METHOD AND SYSTEM FOR DELAYING SOFTWARE GAINING ACCESS TO DATA

[0002] Field of Invention

[0003] The present invention relates to a method of and a system for delaying software gaining access to data. The present invention has application in cyber security. In particular, the present invention has application in protecting computer systems against data theft and data modification.

[0004] Background of the Invention

[0005] Techniques have been developed in an attempt to protect against a cybersecurity threat to computer systems. A malware attack is a common cyberattack, which, when executed, performs actions on computer systems without users’ consent. Such actions can cause damages to users’ computer systems and financial loss to users’ businesses.

[0006] Ransomware is a type of malware that prevents users from accessing data stored on or accessible from their computer systems. Users’ data may be stolen and then deleted or encrypted.

[0007] There are actions users can take at different stages to help prepare their computer systems for potential malware attacks. These actions may include steps to prevent malware from being delivered to and spreading to the computer systems in the first place. Existing anti-malware methods achieve this by analysing detected activities for similarities and relationships with registered suspicious activities detected in the past, for example, blocking websites, files and behaviour known to be malicious. However, it is challenging as it requires the anti-malware methods to continuously monitor behaviour of the computer systems and even to predict the trend of such behaviour. Consequently, if malware is of an unknown type new to the anti-malware methods, suchmalware may not be blocked and thus would be successfully executed by and spread across the computer systems.

[0008] These actions may also include steps to mitigate damage caused after malware has already gained an initial access to, and spread across, the computer systems. Existing anti-malware methods achieve this by means of, for example, constant monitoring of activities of, and review of countermeasures in, the computer systems, and routine backups and updates. As a result, existing anti-malware methods demand significant computational and storage resources. Therefore, users need to ensure that they have necessary infrastructure to maintain the balance between operational security and efficiency.

[0009] Moreover, it has become increasingly challenging to defend against malware, since malware can populate and spread themselves quickly within computer systems once it has gained access. In particular, ransomware can be executed on all targeted computer systems simultaneously and employ multiple threads to encrypt files rapidly, rendering detection and mitigation of ransomware attacks more challenging.

[0010] Summary of invention

[0011] It is desirable to provide a method of and a system for delaying software gaining access to data in a way that is efficient with respect to computation and storage. It is further desirable to provide a method of and a system for preventing software gaining access to data in a way that is efficient with respect to computation and storage. Similarly, it is also desirable that the method and system can delay multiple instances or threads of the software gaining access to data simultaneously.

[0012] According to a first aspect of the present invention, there is provided a computer-implemented method of delaying software gaining access to data, the method comprising the steps:

[0013] - receiving a data access request from the software;

[0014] - in response to the data access request:- generating simulated virtual data by simulating a data structure; and - outputting the simulated virtual data to the software, wherein the simulated virtual data is configured to violate at least one data access protocol.

[0015] Preferably, the simulated virtual data is configured to cause the software to crash, thereby preventing the software gaining access to data.

[0016] Preferably, the simulated virtual data is configured to violate the at least one data access protocol, thereby causing a segmentation fault in the software.

[0017] Alternatively, the simulated virtual data is configured to violate the at least one data access protocol by exhausting the software’s memory, thereby causing an out-of-memory error in the software.

[0018] Preferably, the simulated virtual data is configured to cause a buffer overflow in the software, thereby causing the software to crash.

[0019] Preferably, the simulated virtual data comprises invalid metadata of a data structure, thereby violating the at least one data access protocol.

[0020] Preferably, the at least one data access protocol comprises a filesystem protocol.

[0021] Preferably, the filesystem protocol comprises a network file protocol.

[0022] Preferably, the simulated virtual data is configured to repeatedly list directory entries, which causes the software to repeatedly allocate memory, thereby exhausting the software’s memory.

[0023] Preferably, the simulated virtual data is configured to violate the at least one data access protocol, thereby causing a logic error in the software.Preferably, the simulated virtual data comprises a deceptive response reporting success of a write operation relating to the data access request which in fact was not executed, thereby causing the logic error in the software.

[0024] Preferably, the at least one data access protocol comprises standard file formats.

[0025] Preferably, the simulated virtual data comprises a data structure that is corrupted according to standard file formats, thereby violating the at least one data access protocol.

[0026] Preferably, the at least one data access protocol comprises a database access protocol.

[0027] Preferably, the at least one data access protocol comprises an object store protocol.

[0028] Preferably, the software is a connecting software and the simulated virtual data is configured to cause the connecting software to crash during connection negotiation.

[0029] Preferably, the simulated virtual data has a volatile representation.

[0030] Preferably, the simulated virtual data is representative of a virtual file system.

[0031] Preferably, the simulated virtual data is representative of a virtual storage device.

[0032] Preferably, the simulated virtual data is representative of a network service comprising a virtual database or virtual object store.

[0033] Preferably, the simulated virtual data is configured to delay the software in response to respective data access requests.Preferably, the respective data access requests originate from a plurality of instances of the software.

[0034] Preferably, the simulated virtual data is configured to violate a plurality of data access protocols corresponding to the plurality of instances of the software.

[0035] Preferably, the method comprises the step of detecting whether the software is a malicious application.

[0036] According to a second aspect of the present invention, there is provided a computer program product comprising instructions which, when the program is executed by one or more computers, cause the one or more computers to carry out the steps of a method according to the first aspect.

[0037] According to a third aspect of the present invention, there is provided a system for delaying software gaining access to data, the system comprising:

[0038] - a processor;

[0039] - a memory; and

[0040] - a simulated virtual data module resident in the memory, which when executed by the processor, performs the steps of the method according to the first aspect.

[0041] Preferably, the software is a malicious application, which is resident in the memory.

[0042] Preferably, the simulated virtual data module comprises a virtual file system.

[0043] Preferably, the simulated virtual data module comprises a virtual storage device.

[0044] Preferably, the simulated virtual data module comprises a network service comprising a virtual database or virtual object store.Brief description of drawings

[0045] Embodiments of the present invention will now be described, by way of example only, with reference to the drawings, in which:

[0046] Figure 1 is a flowchart of a method of delaying software gaining access to data in accordance with an embodiment of the present invention.

[0047] Figure 2 illustrates, in schematic form, a system for delaying software gaining access to data in accordance with an embodiment of the present invention.

[0048] Figure 3 illustrates, in schematic form, a system for delaying software gaining access to data in accordance with another embodiment of the present invention.

[0049] Description of embodiments

[0050] In the Figures, elements labelled with reference numerals found in the preceding Figures represent the same elements as described for the respective preceding Figure. For example, feature 204 in Figure 3 corresponds to the same feature 204 as described with reference to Figure 2.

[0051] Features described herein in the context of an embodiment may be provided separately or in any suitable combination with features described herein in the context of other embodiments.

[0052] The method according to embodiments of the present invention delays software gaining access to data, the method comprises the steps: receiving a data access request from the software, then in response to the data access request, generating simulated virtual data by simulating a data structure; and outputting the simulated virtual data to the software, wherein the simulated virtual data is configured to violate at least one data access protocol.In an example, the simulated virtual data has a volatile representation, thereby improving computational efficiency by avoiding the need for a large amount of storage, while providing an effective protection against the software. The volatile representation means that the simulated virtual data is not persistent in a filesystem or database system. The volatile representation may also mean that the simulated virtual data is persistent in a filesystem or database system in a lossy manner, which means that when new data is written old data will be silently discarded.

[0053] The method according to embodiments of the present invention proactively outputs simulated virtual data in response to a data access request originating from both bona fide client applications (normal applications not designed to harm users’ computer systems) and malicious applications, thereby providing more robust and effective data protection. This is advantageous because it has become increasingly challenging to accurately distinguish and identify malicious applications from bona fide client applications.

[0054] The method according to embodiments of the present invention does not rely on deploying malware detection techniques as a prerequisite, which removes the need of constant monitoring of activities of the computer systems. In an example, the method delays software gaining access to data after malware is already resident in memory of a computer system, for example, after malware has been successfully installed on an operating system of the computer system. To enhance protection against malware, the method according to embodiments of the present invention may be used in combination with malware detection techniques to help prevent malware from gaining an initial access to the computer system.

[0055] Figure 1 illustrates a method 100 of delaying software gaining access to data according to an embodiment of the present invention.

[0056] Data to which the software attempts to gain access may comprise user data, computer data and computer resources, for example, customer information, passwords,encryption keys or API access keys as well as valuable documents (e.g. texts, pictures) and databases. Such data may be valuable, or has limited or no value, to users and their businesses. Such data may or may not have a corresponding representation on non-volatile storage devices.

[0057] At step 102, a data access request is made by software.

[0058] The data access request comprises requests to process data (e.g. read, copy, write, delete, modify and / or encrypt data), requests to return information regarding data (e.g. file attributes, data within a file, etc.) and / or requests to indicate success or failure of a particular request (e.g. number of bytes written or read, whether a file rename request was successful and if not what the error code is, etc.).

[0059] The software may comprise bona fide client or malicious applications. The data access request may originate from a malicious application or a remote malicious actor intentionally deploying the malicious application or remotely sending a request to cause harm to a computer system and an owner thereof. In an example, the malicious application carries out data theft or data modification, including ransomware attacks.

[0060] At step 104, the data access request from the software is received.

[0061] At step 106, an alert is raised to warn an operator and / or an automated process of the computer system about an occurrence of the data access request. This is advantageous in the situation that the computer system has already been infected with malware, wherein the operator can react quickly to limit the impact on the infected computer system and the owner thereof.

[0062] At step 108, simulated virtual data is generated by simulating a data structure in response to the data access request. The data structure for example comprises files, directories (including sub-directories), tables, data fields, databases and / or data objects.At this step, simulating a data structure may give rise to one or more simulated virtual data structures.

[0063] In embodiments, the simulated virtual data may be generated in response to the data access request or selected from pre-stored simulated virtual data. The simulated virtual data may be programmatically created and populated in response to the data access request. Random data may be intermingled with the simulated virtual data that has been procedurally created. The simulated virtual data may also be intermingled with data (of limited or no value) present on or accessible from the computer system.

[0064] The simulated virtual data may comprise the one or more simulated virtual data structures, which for example comprise simulated virtual files, directories (including subdirectories), tables, data fields, databases and / or data objects. The simulated virtual data structures may comprise data of limited or no value to users and their businesses. In an example, the simulated virtual data structures have volatile representations. In another example, the simulated virtual data structures are of a size sufficiently large to waste time and resources of the software, thus further delaying the software gaining access to data.

[0065] In an example, the simulated virtual data comprises a simulated virtual decoy file, wherein an alert is generated in response to detecting when and / or after the simulated virtual decoy file is accessed.

[0066] At step 110, the simulated virtual data is output to the software, wherein the simulated virtual data is configured to violate at least one data access protocol. The at least one data access protocol excludes processing protocols relating to an operating system and / or software versioning.

[0067] Violating at least one data access protocol comprises including unexpected steps or data during an exchange that is part of the at least one data access protocol. Violatingat least one data access protocol further comprises excluding expected steps or data during an exchange that is part of the at least one data access protocol.

[0068] Embodiments of the present invention are effective in data protection against malware, which is achieved by forcing an error in the malware and / or causing an unexpected or unintended behaviour of the malware. In an example, embodiments of the present invention cause the malware to crash or be terminated by the malicious actor or by the operating system of a computer system, thereby preventing the malware gaining access to data.

[0069] In an example, the simulated virtual data is configured to violate the at least one data access protocol, thereby causing a segmentation fault in the software. This is advantageous as the segmentation fault is an unrecoverable error that will force the malware to stop operating, thereby effectively preventing the malware from gaining access to data. In an example, the simulated virtual data comprises an invalid memory location allocated for the software, thereby causing the segmentation fault in the software. For example, the simulated virtual data comprises a location the software is not allowed to access or a read-only location for a write operation of the software. In another example, the simulated virtual data comprises one or more values configured to cause an arithmetic error. For example, when ransomware does a calculation, the one or more values configured to cause an arithmetic overflow (e.g. exceeding the maximum value that can be represented by the data type the ransomware uses) or division by zero.

[0070] In an example, the simulated virtual data comprises invalid metadata of a data structure, thereby violating the at least one data access protocol. In an example, the data structure comprises data of real value to users and their businesses. In another example, the data structure comprises the one or more simulated virtual data structures according to embodiments of the present invention. The metadata comprises for example file names, lengths and / or permissions. In an example, the simulated virtual data comprises invalid file names (such as COM1) or invalid characters or file namesthat are longer than permitted by a filesystem (such as NTFS). In another example, the simulated virtual data comprises invalid metadata of a data structure, which is configured to violate the at least one data access protocol, thereby causing the segmentation fault in the software. In an example, the simulated virtual data is configured to cause a buffer overflow in the software, e.g. writing data of a size bigger than the size of a buffer allocated by the software, thereby causing the software to crash or be terminated.

[0071] In an example, the simulated virtual data is configured to violate the at least one data access protocol by exhausting the software’s memory, thereby causing an out-of-memory error in the software. This is advantageous as the out-of-memory error is an unrecoverable error that will force the malware to stop operating, thereby effectively preventing the malware from gaining access to data.

[0072] In an example, the simulated virtual data is configured to cause the software to repeatedly list directory entries, which causes the software to repeatedly allocate memory, thereby exhausting the software’s memory. Advantageously, it consumes time and resources of the software, thereby delaying the software gaining access to data. In another example, the simulated virtual data is configured to cause the software to list infinitely nested directory entries, which causes a stack overflow in the software, thereby causing the software to crash or be terminated. This is effective because ransomware would attempt to work through all the directory entries recursively.

[0073] In an example, the simulated virtual data is configured to cause a logic error in the software, thereby violating the at least one data access protocol. For example, the simulated virtual data comprises a deceptive response reporting success of a write operation relating to the data access request which in fact was not executed, thereby causing the logic error in the software. For example, the simulated virtual data comprises metadata indicating read / write access for read-only data.Embodiments of the present invention are therefore capable of forcing different types of errors and / or causing a variety of unexpected or unintended behaviours, which increases the chances of successfully crashing the software. In an example, the at least one data access protocol comprises a filesystem protocol, such as a network file protocol. In another example, the at least one data access protocol comprises a database access protocol, wherein the database access protocol excludes MySQL protocols connecting via the Java Database Connectivity API (JDBC). In another example, the at least one data access protocol comprises an object store protocol. In embodiments, the software may be a connecting software and the simulated virtual data may be configured to cause the connecting software to crash during connection negotiation.

[0074] In yet another example, the at least one data access protocol comprises standard file formats. In an example, the simulated virtual data comprises a data structure that is corrupted according to standard file formats, thereby violating the at least one data access protocol. In an example, the data structure comprises the one or more simulated virtual data structures according to embodiments of the present invention. Herein, corrupted means that the data structure does not conform to standard file formats. For example, the data structure that is corrupted is a Word document that is improperly structured and designed to crash the software searching its contents; or a zip file that nests another zip file further nesting another zip file and so on; and / or a JPG file that contains invalid headers. In an example, the data structure that is corrupted may recursively comprise further data structures that are corrupted.

[0075] In an example, the simulated virtual data is configured to violate the at least one data access protocol, wherein the simulated virtual data comprises a deceptive response reporting that a file is of a large size (e.g. 5GB) without requiring any storage, or reporting that a file of a size of zero bytes but in fact the file contains data when queried.

[0076] The method according to embodiments of the present invention delays software gaining access to data stored in a local (such as an NTFS formatted disk, ext3 formatted disk orFAT32 formatted memory stick) or remotely shared filesystem, storage device (such as a hard disk, a tape drive, or a block device shared via iSCSI), database (such as PostgreSQL, NoSQL such as MongoDB, or FAISS vector database) and object store (such as Amazon S3).

[0077] Embodiments of the present invention are capable of delaying the software gaining access to different forms of data. In an example, the simulated virtual data is representative of a virtual filesystem. In another example, the simulated virtual data is representative of a virtual storage device. In yet another example, the simulated virtual data is representative of a network service comprising a virtual database or virtual object store.

[0078] Figure 2 illustrates a system 200 for delaying software gaining access to data according to an embodiment of the present invention. The system 200 comprises a processor 203, a memory 206, a storage device 216, an operating system 212 (such as Microsoft Windows™, MacOS™ or Linux™.) and a simulated virtual data module 204 resident in the memory, which when executed by the processor 204, performs the steps of the method according to embodiments of the present invention. In an example, the software is a malicious application 210, which is resident in the memory. In another example, the software is a bona fide client application 208.

[0079] Embodiments of the present invention provide protection against data copying, deleting or modifying data structures of different forms. In an example, the simulated virtual data module comprises a virtual file system, which simulates files and directories and may not be bound by rules of a standard filesystem. In another example, the simulated virtual data module comprises a virtual storage device, which simulates storage blocks and may not be bound by rules of a standard hardware device. In yet another example, the simulated virtual data module comprises a network service comprising a virtual database or virtual object store, wherein the virtual database simulates database and may not be bounded by rules of a standard database, and wherein the virtual objectstore simulates buckets and objects and may not be bounded by rules of a standard object store.

[0080] Since the simulated virtual data may have a volatile representation, for example when it is in the working memory or output buffer of the simulated virtual data module, the virtual file system, the virtual storage device, the virtual database or the virtual object store may appear to contain data without having a corresponding representation on non-volatile storage devices.

[0081] Referring to Figure 2, the simulated virtual data module 204 and the malicious application 210 execute on a client computer system 202. The client computer system 202 may be an end-user computer system comprising one or more personal computers (PCs), mobile computing devices, such as tablet PCs, mobile telephones, and the like.

[0082] In another example, as shown in Figure 3, the simulated virtual data module 204 and the malicious application 210 execute on respective first 302 and second 304 computer systems connected via a communication connection 306, wherein either the first 302 or second 304 computer systems is the client computer system. In an example, the communication connection 306 comprises a network service. In another example, the communication connection 306 comprises a storage device interface, for example, a hardware product representing an external hard disk. The malicious application 210 may be distributed from an originating source or from another computer system infected with the malicious application 210.

[0083] The simulated virtual data module 204 may be configured to introduce a pause in response to the data access request, thus making it more time-consuming for the software to execute scheduled tasks (such as data theft and data modification). In an example, the simulated virtual data module 204 may be configured to reduce the speed at which the simulated virtual data is output. In another example, in response to the data write request, the simulated virtual data module 204 may be configured to accept only asingle byte of data to write in a transaction. In these examples, the simulated virtual data module 204 acts as a slow device, disk or server.

Claims

Claims1. A computer-implemented method of delaying software gaining access to data, the method comprising the steps:- receiving a data access request from the software;- in response to the data access request:- generating simulated virtual data by simulating a data structure; and - outputting the simulated virtual data to the software, wherein the simulated virtual data is configured to violate at least one data access protocol.

2. The method of claim 1 , wherein the simulated virtual data is configured to cause the software to crash, thereby preventing the software gaining access to data.

3. The method of claim 2, wherein the simulated virtual data is configured to violate the at least one data access protocol, thereby causing a segmentation fault in the software.

4. The method of claim 2, wherein the simulated virtual data is configured to violate the at least one data access protocol by exhausting the software’s memory, thereby causing an out-of-memory error in the software.

5. The method of any of claims 2 to 4, wherein the simulated virtual data is configured to cause buffer overflow in the software, thereby causing the software to crash.

6. The method of any preceding claim, wherein the simulated virtual data comprises invalid metadata of a data structure, thereby violating the at least one data access protocol.

7. The method of any preceding claim, wherein the at least one data access protocol comprises a filesystem protocol.

8. The method of claim 7, wherein the filesystem protocol comprises a network file protocol.

9. The method of claim 7 or claim 8, wherein the simulated virtual data is configured to repeatedly list directory entries, which causes the software to repeatedly allocate memory, thereby exhausting the software’s memory.

10. The method of any preceding claim, wherein the simulated virtual data is configured to violate the at least one data access protocol, thereby causing a logic error in the software.

11. The method of claim 10, wherein the simulated virtual data comprises a deceptive response reporting success of a write operation relating to the data access request which in fact was not executed, thereby causing the logic error in the software.

12. The method of any preceding claim, wherein the at least one data access protocol comprises standard file formats.

13. The method of claim 12, wherein the simulated virtual data comprises a data structure that is corrupted according to standard file formats, thereby violating the at least one data access protocol.

14. The method of any preceding claim, wherein the at least one data access protocol comprises a database access protocol.

15. The method of any preceding claim, wherein the at least one data access protocol comprises an object store protocol.

16. The method of any preceding claim, wherein the software is a connecting software and the simulated virtual data is configured to cause the connecting software to crash during connection negotiation.

17. The method of any proceeding claim, wherein the simulated virtual data has a volatile representation.

18. The method of any preceding claim, wherein the simulated virtual data is representative of a virtual file system.

19. The method of any preceding claim, wherein the simulated virtual data is representative of a virtual storage device.

20. The method of any preceding claim, wherein the simulated virtual data is representative of a network service comprising a virtual database or virtual object store.

21. The method of any preceding claim, wherein the simulated virtual data is configured to delay the software in response to respective data access requests.

22. The method of claim 21 , wherein the respective data access requests originate from a plurality of instances of the software.

23. The method of claim 22, wherein the simulated virtual data is configured to violate a plurality of data access protocols corresponding to the plurality of instances of the software.

24. The method of any preceding claim, further comprising the step of detecting whether the software is a malicious application.

25. A computer program product comprising instructions which, when the program is executed by one or more computers, cause the one or more computers to carry out the steps of the method of any preceding claim.

26. A system for delaying software gaining access to data, the system comprising:- a processor;- a memory; and- a simulated virtual data module resident in the memory, which when executed by the processor, performs the method of any of claims 1 to 24.

27. The system of claim 26, wherein the software is a malware application and is resident in the memory.

28. The system of claim 26 or 27, wherein the simulated virtual data module comprises a virtual file system.

29. The system of any of claims 26 to 28, wherein the simulated virtual data module comprises a virtual storage device.

30. The system of any of claims 26 to 29, wherein the simulated virtual data module comprises a network service comprising a virtual database or virtual object store.

Images