426 results about "Ransomware" patented technology

An AI-based Cybersecurity System and Method enable real-time detection, analysis, and mitigation of cyber threats within computing networks using adaptive artificial intelligence. The system continuously monitors network traffic, extracts behavioral and contextual attributes, and applies deep learning-based inference to identify anomalous activities indicating security breaches. The method integrates several computational units, including a network monitoring unit, feature extraction unit, artificial intelligence processor, contextual reasoning processor, and decision synthesis unit, to compute a composite risk index quantifying threat likelihood and severity. A classification processor categorizes detected threats into types such as ransomware, phishing, or unauthorized access, while a mitigation control processor initiates automated response actions to isolate compromised nodes and restore network integrity. An adaptive learning processor updates AI models using feedback from confirmed incidents. This provides a scalable, self-evolving cybersecurity framework that minimizes human intervention and enhances resilience against dynamic and zero-day threats.

Techniques are described for monitoring and analyzing input / output (I / O) messages for patterns indicative of ransomware attacks affecting computer systems of a cloud provider, and for performing various remediation actions to mitigate data loss once a potential ransomware attack is detected. The monitoring of I / O activity for such patterns is performed at least in part by I / O proxy devices coupled to computer systems of a cloud provider network, where an I / O proxy device is interposed in the I / O path between guest operating systems running on a computer system and storage devices to which I / O messages are destined. An I / O proxy device can analyze I / O messages for patterns indicative of potential ransomware attacks by monitoring for anomalous I / O patterns which may, e.g., be indicative of a malicious process attempting to encrypt or otherwise render in accessible a significant portion of one or more storage volumes as part of a ransomware attack.

An artificial intelligence based Offensive Cybersecurity Appliance or OCA for launching a cyber-offensive countermeasure aimed at effectively mitigating sophisticated cyber threats such as real-time Ransomware as a Service (RaaS) directives and emergent killware instigated by malicious-threat actors or cyber attackers. The system covertly uses a vast array of penetrative counter cyber attacks, based on an Advanced Persistent Threat or APT model, to circumvent encountered information security controls instituted by security-based components of a cyber attacker's Local Area Network or LAN. Intrinsically, the penetrative counter cyber attacks are constituted of multiple blended artificial intelligence based cyber attacks. The OCA subsequently uses these blended artificial intelligence based cyber attacks to render the hardware (including the cyber attacker's computer system used to instigate the cyber attack, discovered peripheral smart devices, and network-edge device such as a modem-router) interconnected to the cyber attacker's LAN inoperable by destroying the electronic components associated with that hardware.

Systems and methods for protecting computing systems against ransomware attacks using AI-generated virtual file honeypots. Generative AI comprising a large language model generates virtual file honeypots automatically in response to attack vectors associated with suspect actors and ransomware families.

Systems and methods for ransomware protection in advanced injection-based attacks. The call stack(s) of injected threads are analyzed and a preliminary verdict of benign or malicious can be determined. Additional sensors collect data to associate injected threads with other activities or actors to further estimate the injected thread being benign or malicious. If the threat level is high enough, such as over a given threshold, the preliminary verdict can be determined to be malicious. Subsequently, one or more virtual honeypots are generated for the suspicious threads and the injected thread's response to the virtual honeypots included in anti-ransomware heuristic analysis.

A kernel monitor can be used to mitigate ransomware activity of a host system. In some aspects, a computing system can use the kernel monitor to monitor a set of system calls generated by the host system within a time window to perform a functionality. The kernel monitor can include a respective kernel program monitoring each system call in the set of system calls. The set of system calls can be filtered by the kernel monitor to identify a subset of system calls associated with encrypting a filesystem of the host system. The computing system can determine that the subset of system calls is indicative of ransomware activity associated with the host system based on the subset of system calls exceeding a predefined threshold. Subsequently, the computing system can perform a mitigation operation to mitigate the ransomware activity.

The invention discloses a security encryption transmission system for game data, and relates to the technical field of game data encryption. Comprising a network environment data collection module, a network risk feature extraction module, a feature analysis and machine learning evaluation module, a network environment classification module, a low-risk network Hash algorithm module and a high-risk network Hash algorithm adjustment module, and various parameter information of the current network environment is comprehensively collected. According to the method, the network environment is intelligently evaluated through machine learning, the system recognizes a high-risk situation in real time, the Hash algorithm is dynamically adjusted, stronger encryption is adopted when the risk is high, the communication safety is improved, and viruses and ransomware are prevented. And when the risk is low, a fixed Hash algorithm is used, and high performance is kept. According to the mechanism, data security is effectively guaranteed, resource use is optimized, and security and system performance are balanced.

Systems and methods for ransomware protection in advanced injection-based attacks. Events from a driver are analyzed to identify a potentially malicious actor. A confidence level is calculated for the potentially malicious actor identification to weigh the probability that the actor is malware or a source of malware. Behavior associated with the potentially malicious actor can be collected, if it is likely that the potentially malicious actor is associated with malware, such as if the confidence level is over a predetermined threshold. Subsequently, one or more virtual honeypots are generated for the suspicious processes and the response to the virtual honeypots is included in anti-ransomware heuristic analysis.

The system described herein provides the ability to efficiently back up and restore files within a service, such as a network-based file hosting service or a collaboration service. The system is configured to improve file restoration (may also be referred to as recovery) that occurs in response to an event (may also be referred to as an incident) that compromises a tenant device on which the files reside, thereby preventing access to the files or corrupting the files that are available to the tenant. An example of an event includes a ransomware attack. The described system utilizes a set of defined resources within a boundary to back up tenant files and restore the files. The resources include a metadata database and a blob store. The system combines mutable metadata with immutable content objects within the service to provide faster restoration than the conventional approach.

Systems and methods for forensic resolution of ransomware attacks are provided. The systems and methods define a platform and functionality for addressing ransom based attacks. According to one aspect, the platform and functionality provides a suite of programs and services that enable verification of “ransomed” files to ensure that they can in fact be recovered. If an attack has compromised the integrity of the underlying data so that it cannot be recovered, paying the ransom is an exercise in futility. Additional aspects provide for rapid collection of data that is targeted and specific and that further enables efficient forensic analysis. Many conventional approaches in this space fail to capture requisite detail and / or fail to provide a methodology for handling the volumes of data required to efficiently and effectively track or resolve such attacks. Further aspects provide actionable intelligence that drives result oriented goals for ransomed data and / or compromised systems.

Systems and methods for forensic resolution of ransomware attacks are provided. The systems and methods define a platform and functionality for addressing ransom based attacks. According to one aspect, the platform and functionality provides a suite of programs and services that enable verification of “ransomed” files to ensure that they can in fact be recovered. If an attack has compromised the integrity of the underlying data so that it cannot be recovered, paying the ransom is an exercise in futility. Additional aspects provide for rapid collection of data that is targeted and specific and that further enables efficient forensic analysis. Many conventional approaches in this space fail to capture requisite detail and / or fail to provide a methodology for handling the volumes of data required to efficiently and effectively track or resolve such attacks. Further aspects provide actionable intelligence that drives result oriented goals for ransomed data and / or compromised systems.

Described herein are systems, methods, and software to implement multi-level ransomware detection via file processing. In one example, a computing device conducts a first level of ransomware detection on a file, wherein the first level of ransomware detection comprises identifying features of the file that include a measure of randomness in the file. The computing device further inputs the features to a machine learning model that outputs a determination of whether the file has been attacked. The computing device further determines whether to conduct a second level of ransomware detection based on the determination.

Disclosed herein are devices, systems, and methods for detecting, mitigating, and protecting against malicious actions and / or malicious computer software, including malware and ransomware. Specifically, disclosed embodiments mitigate the threat of ransomware across a wide range of devices including, for example, servers, storage systems, computers, and portable storage devices. At least one embodiment stealthily detects malicious actions by interposing when a file is opened for writing, creating a temporary checkpoint, comparing existing data in the file to what will be written to determine if it is destructive, and, if the behavior is malicious and / or destructive, preserving the checkpoint. At least a further embodiment can be implemented on, and / or ported in, a portable storage device (e.g., a USB device).

Ransomware detection accuracy is improved by analyzing patterns of changes in filename extension counts, relative to each other, that occur in a file system over time. The disclosed approach is malware-agnostic and does not rely on recognizing malware extensions or on real-time monitoring of the target file system. Instead, during each successive backup job of the target file system, the disclosed technology counts different types of filename extensions and compares the counts to each other and to corresponding counts taken in earlier backup jobs. Preferably, the anomaly detection analysis uses machine learning to discern a behavior pattern of the file system, which indicates how filename extensions are distributed and how much they change between backup jobs over time.

Described herein are systems, methods, and software to implement cloud ransomware detection. In one example, a computing device receives features of a file from a second computing device remote from the cloud environment, the features comprising at least a measure of randomness for the file and an identifier for a user associated with a modification to the file. The computing device further user information associated with a user of the modified the file and applies a machine learning model to determine whether the file was attacked based on the features and the user information. The computing device also communicates a notification to the second computing device indicating whether the file was attacked.

A method includes a data protection system determining, based on a first security threat detection process, that a storage system is possibly being targeted by a security threat; performing, based on the determining that the storage system is possibly being targeted by the security threat, a first remedial action with respect to the storage system, the first remedial action comprising generating a snapshot of data stored by the storage system; confirming, based on a second security threat detection process, whether the storage system is possibly being targeted by the security threat; and performing, based on the confirming whether the storage system is possibly being targeted by the security threat, a second remedial action with respect to the storage system, the second remedial action comprising specifying a retention duration with respect to the snapshot.

Described herein are systems, methods, and software to provide ransomware detection using variable levels of encryption. In one implementation, a computing device identifies a set of files, wherein the set of files each comprise a label indicative of whether the file is representative of a safe file or a file attacked by ransomware, and wherein the set of files comprises unencrypted files, partially encrypted files, and fully encrypted file. The computing device further identifies features associated with the set of files and generates a machine learning model that outputs a determination of whether a new file has been attacked based at least on the features in relation to whether a file in the set of files was labeled as attacked.

Systems and methods for forensic resolution of ransomware attacks are provided. The systems and methods define a platform and functionality for addressing ransom based attacks. According to one aspect, the platform and functionality provides a suite of programs and services that enable verification of “ransomed” files to ensure that they can in fact be recovered. If an attack has compromised the integrity of the underlying data so that it cannot be recovered, paying the ransom is an exercise in futility. Additional aspects provide for rapid collection of data that is targeted and specific and that further enables efficient forensic analysis. Many conventional approaches in this space fail to capture requisite detail and / or fail to provide a methodology for handling the volumes of data required to efficiently and effectively track or resolve such attacks. Further aspects provide actionable intelligence that drives result oriented goals for ransomed data and / or compromised systems.

In one example method metadata about one or more entities of a ransomware threat and one or more relationships between the one or more entities of the ransomware threat is extracted from received cyber threat intelligence data by a threat decipher engine. The metadata about the one or more entities of the ransomware threat and the one or more relationships between the one or more entities of the ransomware threat is stored in a repository. A ransomware attack type included in received security sensor data is predicted by a threat prediction engine based on the metadata about the one or more entities of the ransomware threat and the one or more relationships between the one or more entities of the ransomware threat.

Systems and methods are provided to detect ransomware and ransomware-like behavior.

The invention discloses a harmless verification method and device for ransomware encryption behavior protection capability, and the method comprises the steps: responding to a verification signal of a target system for the ransomware encryption behavior protection capability, constructing a bait file in the target system, and determining an original identity verification value of the bait file; simulating the behavior of the ransomware virus, encrypting the bait file at the preset encryption starting time in a preset encryption mode, and in the encryption process, obtaining response information of a target system to the encryption process; if the response information is the restoration response information of the encrypted bait file, acquiring restoration starting time and restoration finishing time for restoring the encrypted bait file by the target system, and acquiring a current identity verification value of the restored bait file; and based on the original identity verification value, the current identity verification value, the preset encryption starting time, the restoration starting time and the restoration completion time, verifying the protection capability of the target system for the ransomware encryption behavior.

Techniques for implementing a scalable automated training framework for anomaly and ransomware detection are disclosed. In some embodiments, a computer system performs operations comprising: instantiating a plurality of virtual machines, each one of the virtual machines being loaded with a corresponding file system; simulating user actions and ransomware on the virtual machines, the simulating of user actions and ransomware on the virtual machines causing changes to the corresponding file systems of the virtual machines; for each one of the plurality of virtual machines, generating a corresponding metadata file based on one or more corresponding snapshots of the virtual machine, the one or more corresponding snapshots indicating the changes to the corresponding file system of the virtual machine; and training a ransomware detection model using a machine learning algorithm and training data, the training data being based on the corresponding metadata files of the virtual machines.

An illustrative method includes maintaining, by a data protection system, a metric associated with a similar block detection process performed by a storage system with respect to data processed by the storage system, the metric representative of a measure of similar blocks in the data as detected by the similar block detection process; determining, by the data protection system, that the metric changes by more than a threshold amount; and determining, by the data protection system based on the determining that the metric changes by more than the threshold amount, that the data processed by the storage system is possibly being targeted by a security threat.

The invention discloses an automatic ransomware collection and analysis method and system based on a large language model in the technical field of network security, and the method comprises the steps: constructing a target data source, collecting a first sample of a ransomware, and capturing the first sample which is actually triggered in an enterprise-level network environment and context behavior data of the first sample from the first sample; an automatic crawler system is established by adopting an open source web crawler framework to establish real-time connection with a malicious code platform, the popularity of a first sample on the malicious code platform is analyzed, and an optimization task is set. According to the method, the natural language processing capacity and the automation technology of a large language model are combined, efficient capture, accurate analysis and quick response of the samples are achieved, an anti-virtualization detection mechanism of the blackmail virus is effectively coped with by implementing an anti-virtualization detection confrontation strategy, and an intelligent protection chain is constructed for network security.

The invention provides a database anti-ransomware method and device based on user SQL (Structured Query Language) feature behavior analysis, and relates to the technical field of database security. The method comprises the following steps: constructing an SQL data set by utilizing a multi-source data aggregation algorithm, a real-time and historical combination algorithm and a data cleaning and checking algorithm; extracting SQL statement structure features according to BERT and a semantic matching method; according to the features, training a user SQL behavior model based on a Transform; in the real-time monitoring stage, a monitoring engine captures a new SQL operation in real time, rapidly extracts features and inputs the features into the trained behavior model for evaluation. Once the deviation between the operation and a normal behavior model exceeds a preset threshold value and suspicious behavior modes such as data encryption, large-scale data deletion or abnormal high-authority operation similar to ransomware are presented, an alarm mechanism is triggered immediately, and a preset protection strategy is executed automatically, so that data loss and business influence are reduced to the greatest extent.

Some examples relate generally to computer architecture software for information security and, in some more particular aspects, to machine learning based on changes in snapshot metadata for anomaly and ransomware detection in a file system.

The invention provides a ransomware classification method and system based on a large model, and the method comprises the steps: carrying out the feature learning and extraction of preprocessed data through a deep learning large model, and obtaining advanced feature representation, and the deep learning large model is a large model which is subjected to the unsupervised or semi-supervised pre-training, and then is subjected to the fine adjustment based on the feature corpus fine adjustment of SFT supervision; performing preliminary classification and refined classification on the ransomware virus according to the advanced feature representation; and dynamically adjusting model parameters according to the novel ransomware sample. According to the method, by introducing a large model technology, limitation and defects in an existing ransomware detection and classification method are overcome, efficient detection and accurate classification of diversified ransomware viruses are achieved, the generalization ability of the model is enhanced, resource consumption is reduced, and usability and applicability of the system are improved; and the method is suitable for a large-scale data environment and quickly evolved ransomware ecology. According to the method, the overall level of network security defense is remarkably improved, and a more reliable and efficient ransomware virus protection scheme is provided for users.

A system for a business entity is disclosed that is configured to execute an authorized countermeasure against a malicious actor via a smart contract in response to the system determining that the malicious actor has performed a malicious action. The system determines that a smart contract established between the business entity and an official agency defines an authorized countermeasure to be performed in the event of the malicious action. The system also determines that the malicious actor has performed the malicious action on the business entity. In response to the determination that the malicious actor has performed the malicious action, the system executes the authorized countermeasure with respect to the malicious actor, which may include one or more of a ransomware attack, a malware distribution, a beacon, a Distributed Denial of Service attack, a destruction of data, an encryption of data, a tokenization of data, or a scrambling of data.

A computer device creates a first snapshot of a storage system at a first moment at which an abnormal operation behavior for the storage system is detected; creates a second snapshot of the storage system at a second moment at which it is determined that the storage system meets an attack detection condition; and then determines, based on a result of comparison between the first snapshot and the second snapshot and data content of one or more groups of operation abnormality data generated by the storage system between the first moment and the second moment, whether the storage system is attacked by ransomware.

The invention discloses a ransomware double-layer defense method combining bait file monitoring and letter verification, and belongs to the field of network security. Firstly, a ransomware double-layer defense mechanism in which a user mode module and a kernel mode module cooperatively work is constructed, and the user mode module generates a bait file and a letter white list and transmits the bait file and the letter white list to the kernel mode module. Then, the bait file monitoring module judges whether the target file of the ransomware is a bait file or not, and if the target file of the ransomware is the bait file, the bait file monitoring module directly blocks malicious behaviors and feeds back the malicious behaviors to the user mode module; and if the ransomware tries to directly encrypt the real user file, the bait file monitoring module transmits the operation request to the dynamic letter verification module for deep verification, and feeds back the processing result to the user mode module. And finally, the malicious process processing module executes a termination and isolation strategy on the malicious process. According to the method, various behaviors of ransomware are comprehensively covered, the false alarm rate is reduced, and the defense real-time performance and effectiveness are improved.