Systems and methods of detecting and responding to malware on a file system
US10469525B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Jun 20, 2017 |
| Grant date | Nov 5, 2019 |
| Priority date | — |
| Expiry date | Oct 18, 2037 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F2221/2101
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
The technology disclosed relates to detecting a data attack on a local file system. The detecting includes scanning a list to identify files of the local file system that have been updated within a timeframe, reading payloads of files identified by the scanning, calculating current content properties from the payload of the files, obtaining historical content properties of the files, determining that a malicious activity is in process by analyzing the current content properties and the historical content properties to identify a pattern of changes that exceeds a predetermined change velocity. Further, the detecting includes determining that the malicious activity is in process by analyzing the current content properties and known patterns of malicious metadata to identify a match between the current metadata and the known patterns of malicious metadata, determining a machine/user that initiated the malicious activity, and implementing a response mechanism that restricts file modifications by the machine/user.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.