Virtual file honey pots for computing systems protection against ransomware attacks

1 . A method for protecting computing systems (CS) against ransomware attacks using virtual file honeypots (VFHs) under virtual honeypot driver control, the method comprising:

identifying the computing system environment;

determining VFH parameters based on the CS environment;

determining that an untrusted process is requesting access to system files of the CS, the system files stored on a storage device, and determining a level of risk posed to the computing system by the untrusted process;

generating a VFH based on the determined parameters, wherein the VFH is not stored on the storage device;

in response to determining the untrusted process is untrusted, providing the untrusted process access to a plurality of VFHs mixed with real system files, wherein a proportion of VFHs to real system files is varied based on the level of risk posed to the computing system by the untrusted process; and

detecting the untrusted process as malware by performing heuristic analysis.

2 . The method of claim 1 , further comprising determining that a process is the untrusted process including at least one of:

determining whether the process is not identified in a list of trusted processes based on one or more of a certificate, a fingerprint, a name, or a process identifier;

requesting a reputation service for the process; or

analyzing a chain of processes and identifying that the process was created by an untrusted process.

3 . The method of claim 1 , further comprising determining that a process is the untrusted process including detecting untrusted threads in trusted processes.

4 . The method of claim 1 , wherein determining virtual file honeypot parameters comprises:

training a machine learning classifier on at least one pattern in file naming on the storage device, at least one file structure of the storage device, and file content of the storage device; and

applying a machine learning classifier to information about the CS environment to determine:

at least one plausible sounding file name, at least one plausible file structure, and at least one plausible file content.

5 . The method of claim 1 , wherein the identifying the CS environment comprises receiving identifying information about a CS type, a CS name, or a CS version.

6 . The method of claim 1 , wherein the identifying the CS environment comprises receiving identifying information about an operating system type or an operating system version.

7 . The method of claim 1 , wherein the identifying the CS environment comprises receiving identifying information about at least one of:

file types and extensions;

common file names, file content, or directory structure;

access permissions of files and directories within the CS;

creation, modification, and access timestamps within the CS;

sensitive data within the CS;

file interactions with other components in the CS;

regulatory and compliance requirements of the CS; or

past cybersecurity incidents or known vulnerabilities within the CS environment.

8 . The method of claim 1 , wherein the CS environment is:

an Industrial Control System (ICS);

an Internet of Things (IoT) system;

a Building Automation Systems (BAS);

a Healthcare Control System;

a Telecommunications Infrastructure;

a Transportation Control System;

an Enterprise Security System; or

a Consumer Security System.

9 . A system for detecting malware in a computing system (CS) environment using a processor, the system comprising:

a virtual honeypot driver under control of the processor and linked with a nonvolatile storage medium, wherein the virtual honeypot driver is configured to control access by a process running on the CS to system files on the nonvolatile storage medium;

a real file, backed up on the nonvolatile storage medium;

a virtual file honeypot, generated by the virtual honeypot driver, not backed up on the nonvolatile storage medium, wherein the virtual file honeypot is not stored on the nonvolatile storage medium;

wherein virtual file honeypot is generated by the virtual honeypot driver using parameters specific to the CS; and

wherein when the process requests access to a CS file system containing the real file, the virtual honeypot driver is configured to give access to a plurality of virtual file honeypots mixed with real system files to the process after determining that the process is untrusted and determining a level of risk posed to the system by the untrusted process, wherein a wherein a proportion of virtual file honeypots to real system files is varied based on the level of risk; and

wherein the virtual honeypot driver is configured to perform heuristic analysis of the untrusted process after the untrusted process is given access to the virtual file honeypot.

10 . The system of claim 9 wherein the virtual honeypot driver is configured to determine that the process is untrusted by:

determining whether the process is not identified in a list of trusted processes based on one or more of a certificate, a fingerprint, a name, or a process identifier;

requesting a reputation service; or

analyzing a chain of processes and identifying the process was created by an untrusted process.

11 . The system of claim 9 , wherein the virtual honeypot driver is configured to determine that the process is untrusted by detecting untrusted threads in trusted processes.

12 . The system of claim 9 , wherein the CS environment is:

an Industrial Control System (ICS);

an Internet of Things (IoT) system;

a Building Automation Systems (BAS);

a Healthcare Control System;

a Telecommunications Infrastructure;

a Transportation Control System;

an Enterprise Security System; or

a Consumer Security System.

13 . A method for controlling client access to an endpoint managed by a host in a computing system (CS) environment using virtual file honeypots (VFHs) under virtual honeypot driver control, the method comprising:

identifying the client and the host for the endpoint computing system environment;

determining VFH parameters based on the endpoint CS environment;

determining that a client process requesting file access to a requested file stored on a storage device of the computing system is untrusted;

determining a level of risk posed to the computing system by the untrusted process;

generating, by the host, at least one VFH based on the determined parameters, wherein the at least one VFH is not stored on the storage device;

providing the untrusted client process access to the at least one VFH and the requested file, wherein a proportion the at least one VFH to the requested file is varied based on the level of risk; and

detecting the untrusted client process as malware by performing heuristic analysis after the untrusted client process receives access to the at least one VFH.

14 . The method of claim 13 , wherein determining that the client process is untrusted comprises at least one of:

determining whether the client process is not identified in a list of trusted processes based on one or more of a certificate, a fingerprint, a name, and a process identifier;

requesting a reputation service for the client process; or

analyzing a chain of processes and identifying the client process was created by an untrusted process.

15 . The method of claim 13 , wherein determining that the client process is untrusted comprises detecting untrusted threads in trusted client processes.

16 . The method of claim 13 , wherein determining virtual file honeypot parameters comprises:

training a machine learning classifier on at least one pattern in file naming on the storage device, at least one file structure of the storage device, and file content of the storage device; and

applying a machine learning classifier to information about the CS environment to determine:

at least one plausible sounding file name, at least one plausible file structure, and at least one plausible file content.

17 . The method of claim 13 , wherein the identifying the endpoint CS environment comprises receiving identifying information about an endpoint CS type, an endpoint CS name, or an endpoint CS version.

18 . The method of claim 13 , wherein the identifying the endpoint CS environment comprises receiving identifying information about an operating system type or operating system version.

19 . The method of claim 13 , wherein the identification of the endpoint CS environment comprises receiving identifying information about at least one of:

file types and extensions;

common file names, file content, or directory structure;

access permissions of files and directories within the endpoint CS;

creation, modification, and access timestamps within the endpoint CS;

sensitive data within the endpoint CS;

file interactions with other components in the endpoint CS;

regulatory and compliance requirements of the endpoint CS; or

past cybersecurity incidents or known vulnerabilities within the endpoint CS environment.

20 . The method of claim 13 , wherein the endpoint CS environment is:

an Industrial Control System (ICS);

an Internet of Things (IoT) system;

a Building Automation Systems (BAS);

a Healthcare Control System;

a Telecommunications Infrastructure;

a Transportation Control System;

an Enterprise Security System; or

a Consumer Security System.