AU2021319159B2 - Advanced ransomware detection - Google Patents

Advanced ransomware detection Download PDF

Info

Publication number
AU2021319159B2
AU2021319159B2 AU2021319159A AU2021319159A AU2021319159B2 AU 2021319159 B2 AU2021319159 B2 AU 2021319159B2 AU 2021319159 A AU2021319159 A AU 2021319159A AU 2021319159 A AU2021319159 A AU 2021319159A AU 2021319159 B2 AU2021319159 B2 AU 2021319159B2
Authority
AU
Australia
Prior art keywords
thread
classifying
files
whitelisted
suspicious
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
AU2021319159A
Other languages
English (en)
Other versions
AU2021319159A1 (en
Inventor
Eldar Aharoni
Or Chechik
Erez Levy
Liav Zigelbaum
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Palo Alto Networks Inc
Original Assignee
Palo Alto Networks Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Palo Alto Networks Inc filed Critical Palo Alto Networks Inc
Publication of AU2021319159A1 publication Critical patent/AU2021319159A1/en
Application granted granted Critical
Publication of AU2021319159B2 publication Critical patent/AU2021319159B2/en
Assigned to PALO ALTO NETWORKS INC. reassignment PALO ALTO NETWORKS INC. Request for Assignment Assignors: PALO ALTO NETWORKS (ISRAEL ANALYTICS) LTD.
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G06F21/565—Static detection by checking file integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1491—Countermeasures against malicious traffic using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Signal Processing (AREA)
  • Bioethics (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Databases & Information Systems (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Storage Device Security (AREA)
  • Pharmaceuticals Containing Other Organic And Inorganic Compounds (AREA)
  • Investigating Or Analysing Materials By The Use Of Chemical Reactions (AREA)
  • Immobilizing And Processing Of Enzymes And Microorganisms (AREA)
  • Debugging And Monitoring (AREA)
AU2021319159A 2020-07-26 2021-06-09 Advanced ransomware detection Active AU2021319159B2 (en)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
US16/939,013 US11520886B2 (en) 2020-07-26 2020-07-26 Advanced ransomware detection
US16/939,013 2020-07-26
PCT/IB2021/055061 WO2022023828A1 (en) 2020-07-26 2021-06-09 Advanced ransomware detection

Publications (2)

Publication Number Publication Date
AU2021319159A1 AU2021319159A1 (en) 2023-02-02
AU2021319159B2 true AU2021319159B2 (en) 2023-09-21

Family

ID=76624079

Family Applications (1)

Application Number Title Priority Date Filing Date
AU2021319159A Active AU2021319159B2 (en) 2020-07-26 2021-06-09 Advanced ransomware detection

Country Status (6)

Country Link
US (2) US11520886B2 (https=)
EP (1) EP4189567A1 (https=)
JP (1) JP7537661B2 (https=)
AU (1) AU2021319159B2 (https=)
IL (2) IL299044B2 (https=)
WO (1) WO2022023828A1 (https=)

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11520886B2 (en) * 2020-07-26 2022-12-06 Palo Alto Networks (Israel Analytics) Ltd. Advanced ransomware detection
WO2022225508A1 (en) * 2021-04-20 2022-10-27 Assured Information Security, Inc. Prevention and remediation of malware based on selective presentation of files to processes
US12524546B2 (en) * 2021-11-10 2026-01-13 Accenture Global Solutions Limited Secure data backup and recovery from cyberattacks
US12265611B2 (en) * 2021-12-01 2025-04-01 Dell Products L.P. System and method for monitoring and detecting of encryption based threats
US11960606B2 (en) * 2022-03-24 2024-04-16 Check Point Software Technologies Ltd. System and method for protecting against data storage attacks
US20230350953A1 (en) * 2022-05-02 2023-11-02 Unisys Corporation System and method for file and file system integrity using meta-data
US12596803B2 (en) * 2023-03-08 2026-04-07 Coveware Inc. Systems and methods for forensic resolution of ransomware attacks
US12361130B2 (en) 2023-04-17 2025-07-15 Palo Alto Networks, Inc. Real-time shellcode detection and prevention
US12481754B2 (en) * 2023-05-24 2025-11-25 Nxp B.V. Data processing system and method for mitigating a malware attack
US12437071B2 (en) * 2023-06-09 2025-10-07 Micro Focus Llc Identification of malicious programs using thread patterns and related data
US12506780B2 (en) * 2023-08-08 2025-12-23 Dell Products L.P. Using decoy datasets for cyber threat detection
US20250063061A1 (en) * 2023-08-16 2025-02-20 Zafran Security LTD System and method for mitigating cyber threats using risk analysis

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180248896A1 (en) * 2017-02-24 2018-08-30 Zitovault Software, Inc. System and method to prevent, detect, thwart, and recover automatically from ransomware cyber attacks, using behavioral analysis and machine learning

Family Cites Families (38)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7152242B2 (en) 2002-09-11 2006-12-19 Enterasys Networks, Inc. Modular system for detecting, filtering and providing notice about attack events associated with network security
KR100843701B1 (ko) 2006-11-07 2008-07-04 소프트캠프(주) 콜 스택에 기록된 정보를 이용한 에이피아이 확인방법
US8205257B1 (en) * 2009-07-28 2012-06-19 Symantec Corporation Systems and methods for preventing threats originating from a non-process based component hosted by a trusted process
KR101244731B1 (ko) 2012-09-11 2013-03-18 주식회사 안랩 디버그 이벤트를 이용한 악성 쉘 코드 탐지 장치 및 방법
US9275223B2 (en) * 2012-10-19 2016-03-01 Mcafee, Inc. Real-time module protection
US8990944B1 (en) * 2013-02-23 2015-03-24 Fireeye, Inc. Systems and methods for automatically detecting backdoors
EP2784716A1 (en) 2013-03-25 2014-10-01 British Telecommunications public limited company Suspicious program detection
KR101445634B1 (ko) 2014-01-27 2014-10-06 주식회사 이글루시큐리티 프로그램의 취약점을 이용한 공격의 탐지 장치 및 방법
US10284591B2 (en) 2014-01-27 2019-05-07 Webroot Inc. Detecting and preventing execution of software exploits
US20180191779A1 (en) * 2016-12-29 2018-07-05 Varmour Networks, Inc. Flexible Deception Architecture
US10091238B2 (en) * 2014-02-11 2018-10-02 Varmour Networks, Inc. Deception using distributed threat detection
US9659182B1 (en) 2014-04-30 2017-05-23 Symantec Corporation Systems and methods for protecting data files
US20160232347A1 (en) 2015-02-09 2016-08-11 Palo Alto Networks, Inc. Mitigating malware code injections using stack unwinding
US10789361B2 (en) * 2016-01-24 2020-09-29 Minerva Labs Ltd. Ransomware attack remediation
US10791133B2 (en) * 2016-10-21 2020-09-29 Tata Consultancy Services Limited System and method for detecting and mitigating ransomware threats
WO2018111271A1 (en) 2016-12-15 2018-06-21 Hewlett-Packard Development Company, L.P. Ransomware attack monitoring
US10169586B2 (en) * 2016-12-31 2019-01-01 Fortinet, Inc. Ransomware detection and damage mitigation
US11822654B2 (en) 2017-04-20 2023-11-21 Morphisec Information Security 2014 Ltd. System and method for runtime detection, analysis and signature determination of obfuscated malicious code
US10503904B1 (en) 2017-06-29 2019-12-10 Fireeye, Inc. Ransomware detection and mitigation
US10860718B2 (en) 2017-07-28 2020-12-08 Mcafee, Llc Protecting computer systems used in virtualization environments against fileless malware
WO2019051507A1 (en) * 2017-09-11 2019-03-14 Carbon Black, Inc. METHODS OF BEHAVIORAL DETECTION AND PREVENTION OF CYBERATTAICS, AS WELL AS APPARATUS AND RELATED TECHNIQUES
US11216559B1 (en) 2017-09-13 2022-01-04 NortonLifeLock Inc. Systems and methods for automatically recovering from malware attacks
US20190109870A1 (en) * 2017-09-14 2019-04-11 Commvault Systems, Inc. Ransomware detection and intelligent restore
US10938854B2 (en) * 2017-09-22 2021-03-02 Acronis International Gmbh Systems and methods for preventive ransomware detection using file honeypots
US11120133B2 (en) * 2017-11-07 2021-09-14 Spinbackup Inc. Ransomware protection for cloud storage systems
US10193918B1 (en) * 2018-03-28 2019-01-29 Malwarebytes Inc. Behavior-based ransomware detection using decoy files
US11544379B2 (en) 2018-04-13 2023-01-03 Webroot Inc. Malicious software detection based on API trust
US11055411B2 (en) 2018-05-10 2021-07-06 Acronis International Gmbh System and method for protection against ransomware attacks
US11010469B2 (en) * 2018-09-13 2021-05-18 Palo Alto Networks, Inc. Preventing ransomware from encrypting files on a target machine
US11089056B2 (en) * 2018-09-28 2021-08-10 Sophos Limited Intrusion detection with honeypot keys
US10789159B2 (en) 2018-12-05 2020-09-29 Sap Se Non-regressive injection of deception decoys
US11616810B2 (en) * 2019-06-04 2023-03-28 Datto, Inc. Methods and systems for ransomware detection, isolation and remediation
US11409868B2 (en) 2019-09-26 2022-08-09 At&T Intellectual Property I, L.P. Ransomware detection and mitigation
US11520886B2 (en) * 2020-07-26 2022-12-06 Palo Alto Networks (Israel Analytics) Ltd. Advanced ransomware detection
CA3199837A1 (en) * 2020-11-24 2022-06-02 Christopher MARTINIC Ransomware mitigation system and method for mitigating a ransomware attack
US11593482B2 (en) 2021-03-04 2023-02-28 Saudi Arabian Oil Company Systems and methods for automating detection and mitigation of an operating system rootkit
EP4330841A1 (en) 2021-05-27 2024-03-06 Palo Alto Networks (Israel Analytics) Ltd. Java deserialization exploit attack detection
US11934801B2 (en) 2021-12-07 2024-03-19 Microsoft Technology Licensing, Llc Multi-modal program inference

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180248896A1 (en) * 2017-02-24 2018-08-30 Zitovault Software, Inc. System and method to prevent, detect, thwart, and recover automatically from ransomware cyber attacks, using behavioral analysis and machine learning

Also Published As

Publication number Publication date
AU2021319159A1 (en) 2023-02-02
US12306945B2 (en) 2025-05-20
IL299044B2 (en) 2025-08-01
IL319777A (en) 2025-05-01
JP7537661B2 (ja) 2024-08-21
EP4189567A1 (en) 2023-06-07
WO2022023828A1 (en) 2022-02-03
US20220027471A1 (en) 2022-01-27
IL299044A (en) 2023-02-01
JP2023534502A (ja) 2023-08-09
US11520886B2 (en) 2022-12-06
US20230084691A1 (en) 2023-03-16
IL299044B1 (en) 2025-04-01

Similar Documents

Publication Publication Date Title
AU2021319159B2 (en) Advanced ransomware detection
US11611586B2 (en) Systems and methods for detecting a suspicious process in an operating system environment using a file honeypots
KR102296754B1 (ko) 보안 저장소 장치
US7836504B2 (en) On-access scan of memory for malware
JP6370747B2 (ja) バーチャルマシーンモニタベースのアンチマルウェアセキュリティのためのシステム及び方法
US8918878B2 (en) Restoration of file damage caused by malware
JP5326062B1 (ja) 非実行ファイル検査装置及び方法
EP3111364B1 (en) Systems and methods for optimizing scans of pre-installed applications
US9432397B2 (en) Preboot environment with system security check
US8667593B1 (en) Methods and apparatuses for protecting against malicious software
KR20190067820A (ko) 컴퓨터 보안 작동을 최적화하기 위한 동적 명성 표시자
US11449602B1 (en) Systems and methods for generating trust binaries
CN110348180B (zh) 一种应用程序启动控制方法和装置
US8640242B2 (en) Preventing and detecting print-provider startup malware
US11928205B1 (en) Systems and methods for implementing cybersecurity using blockchain validation
US11822647B1 (en) Data structure for trust store
US9785775B1 (en) Malware management
EP4478224B1 (en) Whitelisting method for blocking script-based malware
US10339313B2 (en) System and method for bypassing a malware infected driver
US12248585B2 (en) Runtime risk assessment to protect storage systems from data loss
US20240126882A1 (en) Instructions to process files in virtual machines
US12346430B1 (en) Systems and methods for implementing cybersecurity using trust binaries
US20250371130A1 (en) Preventing EDR Termination using Vulnerable Drivers
HK40018996A (en) Secure storage device and computer security method
HK40018996B (zh) 安全存储装置与计算机安全性方法

Legal Events

Date Code Title Description
FGA Letters patent sealed or granted (standard patent)
PC Assignment registered

Owner name: PALO ALTO NETWORKS INC.

Free format text: FORMER OWNER(S): PALO ALTO NETWORKS (ISRAEL ANALYTICS) LTD.