511 results about "Ransomware" patented technology

An AI-based Cybersecurity System and Method enable real-time detection, analysis, and mitigation of cyber threats within computing networks using adaptive artificial intelligence. The system continuously monitors network traffic, extracts behavioral and contextual attributes, and applies deep learning-based inference to identify anomalous activities indicating security breaches. The method integrates several computational units, including a network monitoring unit, feature extraction unit, artificial intelligence processor, contextual reasoning processor, and decision synthesis unit, to compute a composite risk index quantifying threat likelihood and severity. A classification processor categorizes detected threats into types such as ransomware, phishing, or unauthorized access, while a mitigation control processor initiates automated response actions to isolate compromised nodes and restore network integrity. An adaptive learning processor updates AI models using feedback from confirmed incidents. This provides a scalable, self-evolving cybersecurity framework that minimizes human intervention and enhances resilience against dynamic and zero-day threats.

Techniques are described for monitoring and analyzing input / output (I / O) messages for patterns indicative of ransomware attacks affecting computer systems of a cloud provider, and for performing various remediation actions to mitigate data loss once a potential ransomware attack is detected. The monitoring of I / O activity for such patterns is performed at least in part by I / O proxy devices coupled to computer systems of a cloud provider network, where an I / O proxy device is interposed in the I / O path between guest operating systems running on a computer system and storage devices to which I / O messages are destined. An I / O proxy device can analyze I / O messages for patterns indicative of potential ransomware attacks by monitoring for anomalous I / O patterns which may, e.g., be indicative of a malicious process attempting to encrypt or otherwise render in accessible a significant portion of one or more storage volumes as part of a ransomware attack.

An artificial intelligence based Offensive Cybersecurity Appliance or OCA for launching a cyber-offensive countermeasure aimed at effectively mitigating sophisticated cyber threats such as real-time Ransomware as a Service (RaaS) directives and emergent killware instigated by malicious-threat actors or cyber attackers. The system covertly uses a vast array of penetrative counter cyber attacks, based on an Advanced Persistent Threat or APT model, to circumvent encountered information security controls instituted by security-based components of a cyber attacker's Local Area Network or LAN. Intrinsically, the penetrative counter cyber attacks are constituted of multiple blended artificial intelligence based cyber attacks. The OCA subsequently uses these blended artificial intelligence based cyber attacks to render the hardware (including the cyber attacker's computer system used to instigate the cyber attack, discovered peripheral smart devices, and network-edge device such as a modem-router) interconnected to the cyber attacker's LAN inoperable by destroying the electronic components associated with that hardware.

Systems and methods for protecting computing systems against ransomware attacks using AI-generated virtual file honeypots. Generative AI comprising a large language model generates virtual file honeypots automatically in response to attack vectors associated with suspect actors and ransomware families.

Systems and methods for ransomware protection in advanced injection-based attacks. The call stack(s) of injected threads are analyzed and a preliminary verdict of benign or malicious can be determined. Additional sensors collect data to associate injected threads with other activities or actors to further estimate the injected thread being benign or malicious. If the threat level is high enough, such as over a given threshold, the preliminary verdict can be determined to be malicious. Subsequently, one or more virtual honeypots are generated for the suspicious threads and the injected thread's response to the virtual honeypots included in anti-ransomware heuristic analysis.

Apparatuses, systems, and techniques for classifying one or more computer programs executed by a host device as being ransomware using a machine learning (ML) detection system. An integrated circuit is coupled to physical memory of a host device via a host interface. The integrated circuit hosts a hardware-accelerated security service to protect one or more computer programs executed by the host device. The security service obtains a series of snapshots of data stored in the physical memory and extracts a set of features from each snapshot of the series of snapshots, each snapshot representing the data at a point in time. The security service classifies a process of the one or more computer programs as ransomware or non-ransomware using the set of features and outputs an indication of ransomware responsive to the process being classified as ransomware.

A kernel monitor can be used to mitigate ransomware activity of a host system. In some aspects, a computing system can use the kernel monitor to monitor a set of system calls generated by the host system within a time window to perform a functionality. The kernel monitor can include a respective kernel program monitoring each system call in the set of system calls. The set of system calls can be filtered by the kernel monitor to identify a subset of system calls associated with encrypting a filesystem of the host system. The computing system can determine that the subset of system calls is indicative of ransomware activity associated with the host system based on the subset of system calls exceeding a predefined threshold. Subsequently, the computing system can perform a mitigation operation to mitigate the ransomware activity.

The invention discloses a security encryption transmission system for game data, and relates to the technical field of game data encryption. Comprising a network environment data collection module, a network risk feature extraction module, a feature analysis and machine learning evaluation module, a network environment classification module, a low-risk network Hash algorithm module and a high-risk network Hash algorithm adjustment module, and various parameter information of the current network environment is comprehensively collected. According to the method, the network environment is intelligently evaluated through machine learning, the system recognizes a high-risk situation in real time, the Hash algorithm is dynamically adjusted, stronger encryption is adopted when the risk is high, the communication safety is improved, and viruses and ransomware are prevented. And when the risk is low, a fixed Hash algorithm is used, and high performance is kept. According to the mechanism, data security is effectively guaranteed, resource use is optimized, and security and system performance are balanced.

Systems and methods for ransomware protection in advanced injection-based attacks. Events from a driver are analyzed to identify a potentially malicious actor. A confidence level is calculated for the potentially malicious actor identification to weigh the probability that the actor is malware or a source of malware. Behavior associated with the potentially malicious actor can be collected, if it is likely that the potentially malicious actor is associated with malware, such as if the confidence level is over a predetermined threshold. Subsequently, one or more virtual honeypots are generated for the suspicious processes and the response to the virtual honeypots is included in anti-ransomware heuristic analysis.

The system described herein provides the ability to efficiently back up and restore files within a service, such as a network-based file hosting service or a collaboration service. The system is configured to improve file restoration (may also be referred to as recovery) that occurs in response to an event (may also be referred to as an incident) that compromises a tenant device on which the files reside, thereby preventing access to the files or corrupting the files that are available to the tenant. An example of an event includes a ransomware attack. The described system utilizes a set of defined resources within a boundary to back up tenant files and restore the files. The resources include a metadata database and a blob store. The system combines mutable metadata with immutable content objects within the service to provide faster restoration than the conventional approach.

Systems and methods for forensic resolution of ransomware attacks are provided. The systems and methods define a platform and functionality for addressing ransom based attacks. According to one aspect, the platform and functionality provides a suite of programs and services that enable verification of “ransomed” files to ensure that they can in fact be recovered. If an attack has compromised the integrity of the underlying data so that it cannot be recovered, paying the ransom is an exercise in futility. Additional aspects provide for rapid collection of data that is targeted and specific and that further enables efficient forensic analysis. Many conventional approaches in this space fail to capture requisite detail and / or fail to provide a methodology for handling the volumes of data required to efficiently and effectively track or resolve such attacks. Further aspects provide actionable intelligence that drives result oriented goals for ransomed data and / or compromised systems.

Systems and methods for forensic resolution of ransomware attacks are provided. The systems and methods define a platform and functionality for addressing ransom based attacks. According to one aspect, the platform and functionality provides a suite of programs and services that enable verification of “ransomed” files to ensure that they can in fact be recovered. If an attack has compromised the integrity of the underlying data so that it cannot be recovered, paying the ransom is an exercise in futility. Additional aspects provide for rapid collection of data that is targeted and specific and that further enables efficient forensic analysis. Many conventional approaches in this space fail to capture requisite detail and / or fail to provide a methodology for handling the volumes of data required to efficiently and effectively track or resolve such attacks. Further aspects provide actionable intelligence that drives result oriented goals for ransomed data and / or compromised systems.

Described herein are systems, methods, and software to implement multi-level ransomware detection via file processing. In one example, a computing device conducts a first level of ransomware detection on a file, wherein the first level of ransomware detection comprises identifying features of the file that include a measure of randomness in the file. The computing device further inputs the features to a machine learning model that outputs a determination of whether the file has been attacked. The computing device further determines whether to conduct a second level of ransomware detection based on the determination.

Disclosed herein are devices, systems, and methods for detecting, mitigating, and protecting against malicious actions and / or malicious computer software, including malware and ransomware. Specifically, disclosed embodiments mitigate the threat of ransomware across a wide range of devices including, for example, servers, storage systems, computers, and portable storage devices. At least one embodiment stealthily detects malicious actions by interposing when a file is opened for writing, creating a temporary checkpoint, comparing existing data in the file to what will be written to determine if it is destructive, and, if the behavior is malicious and / or destructive, preserving the checkpoint. At least a further embodiment can be implemented on, and / or ported in, a portable storage device (e.g., a USB device).

Ransomware detection accuracy is improved by analyzing patterns of changes in filename extension counts, relative to each other, that occur in a file system over time. The disclosed approach is malware-agnostic and does not rely on recognizing malware extensions or on real-time monitoring of the target file system. Instead, during each successive backup job of the target file system, the disclosed technology counts different types of filename extensions and compares the counts to each other and to corresponding counts taken in earlier backup jobs. Preferably, the anomaly detection analysis uses machine learning to discern a behavior pattern of the file system, which indicates how filename extensions are distributed and how much they change between backup jobs over time.

Described herein are systems, methods, and software to implement cloud ransomware detection. In one example, a computing device receives features of a file from a second computing device remote from the cloud environment, the features comprising at least a measure of randomness for the file and an identifier for a user associated with a modification to the file. The computing device further user information associated with a user of the modified the file and applies a machine learning model to determine whether the file was attacked based on the features and the user information. The computing device also communicates a notification to the second computing device indicating whether the file was attacked.

A method includes a data protection system determining, based on a first security threat detection process, that a storage system is possibly being targeted by a security threat; performing, based on the determining that the storage system is possibly being targeted by the security threat, a first remedial action with respect to the storage system, the first remedial action comprising generating a snapshot of data stored by the storage system; confirming, based on a second security threat detection process, whether the storage system is possibly being targeted by the security threat; and performing, based on the confirming whether the storage system is possibly being targeted by the security threat, a second remedial action with respect to the storage system, the second remedial action comprising specifying a retention duration with respect to the snapshot.

Described herein are systems, methods, and software to provide ransomware detection using variable levels of encryption. In one implementation, a computing device identifies a set of files, wherein the set of files each comprise a label indicative of whether the file is representative of a safe file or a file attacked by ransomware, and wherein the set of files comprises unencrypted files, partially encrypted files, and fully encrypted file. The computing device further identifies features associated with the set of files and generates a machine learning model that outputs a determination of whether a new file has been attacked based at least on the features in relation to whether a file in the set of files was labeled as attacked.

The present embodiments relate to detecting malware in a document management system (DMS). File stubs representing files remotely stored in a DMS can be presented in file managers at local computing devices for review / interaction on the local computing devices. A file stub for a specific file can be selected in the file manager, and a request to download the file can be provided to the DMS. The process in requesting the download of the file can be processed to determine whether the process is user-initiated or programmatic-initiated. If the process is user-initiated (e.g., initiated by a user on the local computing device), the file can be provided to the local computing device. Programmatic-initiated processes can be a result of software or malware, and mitigating actions can be taken if the request to download the file is a programmatic-initiated process.

Systems and methods for forensic resolution of ransomware attacks are provided. The systems and methods define a platform and functionality for addressing ransom based attacks. According to one aspect, the platform and functionality provides a suite of programs and services that enable verification of “ransomed” files to ensure that they can in fact be recovered. If an attack has compromised the integrity of the underlying data so that it cannot be recovered, paying the ransom is an exercise in futility. Additional aspects provide for rapid collection of data that is targeted and specific and that further enables efficient forensic analysis. Many conventional approaches in this space fail to capture requisite detail and / or fail to provide a methodology for handling the volumes of data required to efficiently and effectively track or resolve such attacks. Further aspects provide actionable intelligence that drives result oriented goals for ransomed data and / or compromised systems.

In one example method metadata about one or more entities of a ransomware threat and one or more relationships between the one or more entities of the ransomware threat is extracted from received cyber threat intelligence data by a threat decipher engine. The metadata about the one or more entities of the ransomware threat and the one or more relationships between the one or more entities of the ransomware threat is stored in a repository. A ransomware attack type included in received security sensor data is predicted by a threat prediction engine based on the metadata about the one or more entities of the ransomware threat and the one or more relationships between the one or more entities of the ransomware threat.

Systems and methods are provided to detect ransomware and ransomware-like behavior.

A ransomware attack detection method and a related device. The method comprises: determining a target fingerprint according to a target input-output (IO) sequence (S310); according to an attack fingerprint library and the target fingerprint, determining the similarities between attack fingerprints in the attack fingerprint library and the target fingerprint (S320); and according to the similarities between the target fingerprint and the attack fingerprints, determining that the target IO sequence is a normal IO sequence or a ransomware attack IO sequence (S330). By means of determining a target fingerprint corresponding to an IO sequence in real time and comparing the target fingerprint with attack fingerprints in an attack fingerprint library, whether the IO sequence is normal can be determined more quickly, without the need to calculate and detect data content corresponding to the IO sequence, and thus a ransomware attack detection speed can be increased.

The invention discloses a harmless verification method and device for ransomware encryption behavior protection capability, and the method comprises the steps: responding to a verification signal of a target system for the ransomware encryption behavior protection capability, constructing a bait file in the target system, and determining an original identity verification value of the bait file; simulating the behavior of the ransomware virus, encrypting the bait file at the preset encryption starting time in a preset encryption mode, and in the encryption process, obtaining response information of a target system to the encryption process; if the response information is the restoration response information of the encrypted bait file, acquiring restoration starting time and restoration finishing time for restoring the encrypted bait file by the target system, and acquiring a current identity verification value of the restored bait file; and based on the original identity verification value, the current identity verification value, the preset encryption starting time, the restoration starting time and the restoration completion time, verifying the protection capability of the target system for the ransomware encryption behavior.

Techniques for implementing a scalable automated training framework for anomaly and ransomware detection are disclosed. In some embodiments, a computer system performs operations comprising: instantiating a plurality of virtual machines, each one of the virtual machines being loaded with a corresponding file system; simulating user actions and ransomware on the virtual machines, the simulating of user actions and ransomware on the virtual machines causing changes to the corresponding file systems of the virtual machines; for each one of the plurality of virtual machines, generating a corresponding metadata file based on one or more corresponding snapshots of the virtual machine, the one or more corresponding snapshots indicating the changes to the corresponding file system of the virtual machine; and training a ransomware detection model using a machine learning algorithm and training data, the training data being based on the corresponding metadata files of the virtual machines.

The invention provides a ransomware attack detection method and related equipment. The method comprises the following steps: determining a target fingerprint according to a target input / output (IO) sequence; according to an attack fingerprint database and the target fingerprint, determining the similarity between the attack fingerprint in the attack fingerprint database and the target fingerprint; and according to the similarity between the target fingerprint and the attack fingerprint, determining that the target IO sequence is a normal IO sequence or a ransomware attack IO sequence. According to the method, the target fingerprints corresponding to the IO sequence are determined in real time and compared with the attack fingerprints in the attack fingerprint database, so that whether the IO sequence is normal or not can be rapidly determined, data content corresponding to the IO sequence does not need to be calculated and detected, and then the speed of detecting the ransomware attack can be increased.

An illustrative method includes maintaining, by a data protection system, a metric associated with a similar block detection process performed by a storage system with respect to data processed by the storage system, the metric representative of a measure of similar blocks in the data as detected by the similar block detection process; determining, by the data protection system, that the metric changes by more than a threshold amount; and determining, by the data protection system based on the determining that the metric changes by more than the threshold amount, that the data processed by the storage system is possibly being targeted by a security threat.

The invention discloses an automatic ransomware collection and analysis method and system based on a large language model in the technical field of network security, and the method comprises the steps: constructing a target data source, collecting a first sample of a ransomware, and capturing the first sample which is actually triggered in an enterprise-level network environment and context behavior data of the first sample from the first sample; an automatic crawler system is established by adopting an open source web crawler framework to establish real-time connection with a malicious code platform, the popularity of a first sample on the malicious code platform is analyzed, and an optimization task is set. According to the method, the natural language processing capacity and the automation technology of a large language model are combined, efficient capture, accurate analysis and quick response of the samples are achieved, an anti-virtualization detection mechanism of the blackmail virus is effectively coped with by implementing an anti-virtualization detection confrontation strategy, and an intelligent protection chain is constructed for network security.

The invention provides a database anti-ransomware method and device based on user SQL (Structured Query Language) feature behavior analysis, and relates to the technical field of database security. The method comprises the following steps: constructing an SQL data set by utilizing a multi-source data aggregation algorithm, a real-time and historical combination algorithm and a data cleaning and checking algorithm; extracting SQL statement structure features according to BERT and a semantic matching method; according to the features, training a user SQL behavior model based on a Transform; in the real-time monitoring stage, a monitoring engine captures a new SQL operation in real time, rapidly extracts features and inputs the features into the trained behavior model for evaluation. Once the deviation between the operation and a normal behavior model exceeds a preset threshold value and suspicious behavior modes such as data encryption, large-scale data deletion or abnormal high-authority operation similar to ransomware are presented, an alarm mechanism is triggered immediately, and a preset protection strategy is executed automatically, so that data loss and business influence are reduced to the greatest extent.

A method for identifying ransomware in order to prevent unauthorized manipulation of a computer file and / or for preventing unauthorized manipulation of a computer file. The method includes: determining an entropy value in response to a write request issued by a running process; and in response to a determination that the entropy value exceeds a predetermined threshold, identifying the running process as ransomware and / or preventing data stored at a storage device from being manipulated by the running process. Aspects further include: in response to a determination that the entropy value exceeds a predetermined threshold and a determination that a socket request or a delete request was issued by the running process, preventing data stored at a storage device from being manipulated by the running process.