Automated detection and remediation of ransomware attacks involving a storage device of a computer network
US10055582B1 · kind B1 · utility
Assignee
Inventors
Key dates
| Filing date | Sep 19, 2016 |
| Grant date | Aug 21, 2018 |
| Priority date | — |
| Expiry date | Jan 26, 2037 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F2221/034
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
An apparatus in one embodiment comprises a security appliance having a processor coupled to a memory. The security appliance is associated with at least one storage device and comprises a ransomware detector configured to generate a detection score for one or more sets of files stored in the storage device. The ransomware detector comprises a file analyzer configured to compare characteristics relating to a current state of the files with information stored in a file history database, and a detection score generator having a weighting module for applying weights to respective comparison results from the file analyzer in generating the detection score for the one or more sets of files. The ransomware detector is further configured to generate an alert if the detection score for the one or more sets of files exceeds a specified threshold. The alert may be transmitted by the security appliance to a network security system.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.