Virtual canary files to mitigate ransomware attacks

1 . A Computer Agent to detect and mitigate ransomware attacks, configured to perform on one or more processors and memory coupled to the one or more processors, wherein the memory includes one or more partitions and computer instructions which when executed by the one or more processors causes the one or more processors to perform operations via:

a Hard Disk for

storing Real Physical Files

a File System Driver for

opening, reading and writing the Real Physical Files to the Hard Disk;

a Kernel Driver situated between the File System Driver and an Application for

responding to file access requests to the Hard Disk by the Application;

dynamically creating Virtual Canary Files in a memory that is physical Random Access Memory (RAM) or virtual memory separate from the Hard Disk responsive to the file access requests;

controlling file system operations, including I/O events for the reading and writing, to the Virtual Canary Files to dynamically detect whether the Application is ransomware, and mitigate ransoming of the Real Physical Files, without sending file access requests to the storage device by

creating in-memory structures that represent the Virtual Canary Files and attributes as Real Physical Files in the Hard Disk to the Application;

dynamically changing the attributes of the Virtual Canary Files by way of the in-memory structures in real-time to target ransomware at run-time,

wherein the Kernel Driver is hooked into the File System Driver using a Layered File System (LFS) model that virtualizes file properties of the Virtual Canary Files to filter a directory query, intercept a filename list from the directory query, and dynamically add Virtual Canary Files to the filename list,

whereby ransomware attacks are detected early without losing customer data, without polluting the customer's file system or consuming additional space on a storage device of the Hard Disk,

wherein the Computer Agent is deployed or installed to execute on one among a system with infrastructure components for Big Data, Containers, Cloud, Databases and File Servers.

2 . The Computer Agent of claim 1 , wherein the step of controlling file system operations comprises:

querying the attributes of the Real Physical Files in a Folder Directory represented by the Hard Disk;

mimicking the attributes of the Real Physical Files to the Virtual Canary Files in the memory;

wherein the attributes of the Virtual Canary Files are selected from one or more among a name, size, extension, and data or other property or characteristic of the Real Physical Files.

3 . The Computer Agent of claim 1 , wherein the Kernel Driver via the Layered File System (LFS) model in kernel mode controls file open, read, write and delete requests so as to present the Virtual Canary Files as real documents amongst other physical real files of a Process (A, B) to the Application responsive to the Application enumerating a file system of the Hard Disk.

4 . The Computer Agent of claim 1 , whereby the Kernel Driver via the Layered File System (LFS) in kernel mode controls enumeration behavior of the file system of the Hard Disk and inserts the Virtual Canary Files at random locations in the Folder Directory amongst other physical real files of a Process (A, B).

5 . The Computer Agent of claim 1 , wherein the Kernel Driver via the Layered File System (LFS) controls various virtualized attributes of the Virtual Canary Files presented as real documents amongst other physical real files of a Process (A, B) responsive to detecting:

a type of malware attack associated with the Application; and

a user trying to access the real documents and other physical real files.

6 . The Computer Agent of claim 2 , wherein the Kernel Driver controls various attributes of the real documents responsive to identifying:

a perceived trust level of a process associated with the Application,

wherein the Kernel Driver hides or makes visible Virtual Canary Files according to the perceived trust level.

7 . The Computer Agent of claim 3 , wherein the Kernel Driver dynamically disables and enables the Virtual Canary Files on a per-process basis, such that the Virtual Canary Files differ between applications, threads and processes with respect to their location, property, size, content, or characteristics.

8 . The Computer Agent of claim 6 , wherein the Kernel Driver creates more Virtual Canary Files in real-time upon detection of ransomware activities, thereby trapping ransomware exploits and mitigating access to the Real Physical Files.

9 . The Computer Agent of claim 7 , wherein the Kernel Drivers changes one among a location, property, size, content, characteristic or attribute of a Canary File and uses an artificial intelligence module or generative artificial intelligence module to learn a behavior of the ransomware.

10 . The Computer Agent of claim 1 , wherein the Kernel Driver writes data with predetermined patterns at known write offsets in the Virtual Canary Files, and upon detecting a data overwrite at the offset, triggers a ransomware event, whereby the Kernel Driver dynamically changes one or more among:

how many Virtual Canary Files are created,

sequencing order for an enumeration process of the Virtual Canary Files;

attributes of Virtual Canary Files, including one or more among a name, size, label, visible type, a hidden type, and data therein; and

placement of Virtual Canary Files at random locations in the memory.

11 . The Computer Agent of claim 2 , wherein in-memory structures are internal structures representing Virtual Canary Files that do reside in virtual memory, though actual contents of the Virtual Canary Files do not reside in virtual memory, such that the Virtual Canary Files do not consume a large amount of memory.

12 . A method for a Kernel Driver situated between the File System Driver and an Application to detect and mitigate ransomware attacks comprising steps of:

storing Real Physical Files via a Hard Disk;

opening, reading and writing the Real Physical Files to the Hard Disk a File System Driver;

responding to file access requests to the Hard Disk by the Application;

dynamically creating Virtual Canary Files in a memory that is physical Random Access Memory (RAM) or virtual memory separate from the Hard Disk responsive to the file access requests;

controlling file system operations, including I/O events for the reading and writing, to the Virtual Canary Files to dynamically detect whether the Application is ransomware, and mitigate ransoming of the Real Physical Files, without sending file access requests to the storage device by

creating in-memory structures that represent the Virtual Canary Files and attributes as Real Physical Files in the Hard Disk to the Application;

dynamically changing the attributes of the Virtual Canary Files by way of the in-memory structures in real-time to target ransomware at run-time,

 wherein the Kernel Driver is hooked into the File System Driver using a Layered File System (LFS) model that virtualizes file properties of the Virtual Canary Files to filter a directory query, intercept a filename list from the directory query, and dynamically add Virtual Canary Files to the filename list,

whereby ransomware attacks are detected early without losing customer data, without polluting the customer's file system or consuming additional space on a storage device of the Hard Disk,

wherein the Kernel Driver is deployed or installed to execute on a Computer Agent among a system with infrastructure components for Big Data, Containers, Cloud, Databases and File Servers.

13 . The method of claim 12 , wherein the step of controlling file system operations comprises:

querying the attributes of the Real Physical Files in a Folder Directory represented by the Hard Disk;

mimicking the attributes of the Real Physical Files to the Virtual Canary Files in the memory;

wherein the attributes of the Virtual Canary Files are selected from one or more among a name, size, extension, and data or other property or characteristic of the Real Physical Files,

wherein the in-memory structures are internal structures representing Virtual Canary Files that do reside in virtual memory, though actual contents of the Virtual Canary Files do not reside in virtual memory, such that the Virtual Canary Files do not consume a large amount of memory.