Method and system for generating decoy files using a deep learning engine for protection against ransomware attacks

1 . A method of generating decoy files using a deep learning engine for protection against ransomware attacks, the method comprising:

extracting, by the deep learning engine, a plurality of features from most recently used (MRU) user files in a folder of a local file system, the plurality of features comprising at least one of file names, position of files in each folder, file size, date of modification, date of creation, size, author, heading, number of paragraphs, frequency of used Named Entities (NE), and categories of Named Entities;

converting, by the deep learning engine, the plurality of features into a vector format using vectorization tools configured to handle heterogeneous metadata and content features;

estimating, by the deep learning engine, an error between the vectorized features and a target vector based on a learned profile of user file characteristics derived from the plurality of features of MRU user files, wherein the error is computed based on entropy difference between an original MRU user file and a candidate decoy file;

generating, by the deep learning engine, one or more decoy files having entropy matching that of the MRU user files, if the error is less than a predefined threshold; and

periodically updating, by the deep learning engine, the one or more decoy files or upon changes in user files in the folder of a local file system.

2 . The method of claim 1 , comprising:

creating decoy processes, by the deep learning engine, wherein the decoy processes comprise accessing the decoy files randomly and making them appear as recently accessed files to misdirect ransomware attacks.

3 . The method of claim 2 , comprising:

creating, by the deep learning engine, fake user accounts with administrator rights to misdirect ransomware attacks; and

implementing a trap layer on a file system that makes use of the one or more decoy files, the decoy processes, and the fake user accounts to identify the ransomware infection.

4 . The method of claim 1 , comprising:

creating, by the deep learning engine, fake user accounts with administrator rights to misdirect ransomware attacks.

5 . The method of claim 1 , comprising:

monitoring runtime suspicious behaviour for identifying ransomware attack, wherein the monitoring comprises:

alerting on detection of suspicious activity; and

triggering a rollback mechanism, wherein file backups are initiated to control spread of infection to other files or backups.

6 . The method of claim 1 , wherein the user files are at least one of .doc, .docx, .xls, .xlsx, .ppt, .pptx, .rtf, .odt, .ods, .odp, PDF, .JPG, .PNG, raw camera files, .txt, .RTF, etc., .sql, .dba, .mdb, .odb, .db3, sqlite3, .zip, .rar, .7z, .pst, .pem, and .crt.

7 . A system for generating decoy files for protection against ransomware attacks, the system comprising:

a processor; and

a memory communicatively coupled to the processor,

the memory comprising a deep learning engine configured to:

extract a plurality of features from most recently used (MRU) user files in a folder of file names, position of files in each folder, file size, date of modification, date of creation, size, author, heading, number of paragraphs, frequency of used Named Entities (NE), and categories of Named Entities;

convert the plurality of features into a vector format using vectorization tools configured to handle heterogeneous metadata and content features;

estimate an error between the vectorized of the plurality of features and a target vector based on a learned profile of user file characteristics derived from the plurality of features of MRU user files, wherein the error is computed based on entropy difference between an original MRU user file and a candidate decoy file;

generate one or more decoy files having entropy matching that of the MRU user files if the error is less than a predefined threshold; and

periodically update the one or more decoy files or upon changes in user files in the folder of a local file system.

8 . The system of claim 7 , wherein the deep learning engine is configured to trigger creation of decoy processes, wherein the decoy processes comprise accessing the decoy files randomly and making them appear as recently accessed files to misdirect ransomware attacks.

9 . The system of claim 7 , wherein the deep learning engine is configured to trigger creation of fake user accounts with administrator rights to misdirect ransomware attacks.