Ransomware discovery by detection of transmit/overwrite processes
One method includes detecting write operations requested by a process with respect to data, determining whether the data is being transmitted, by the same process, to a recipient that is unknown or unauthorized to receive the data, when it is determined that the data is being transmitted to the recipient that is unknown or unauthorized to receive the data, disabling writes to the data, for subsequent requested write operations, logging differentials associated with those subsequent requested write operations, and alerting a security protocol that the process is a suspected ransomware process.
1 . A method, comprising:
detecting write operations requested by a process operating in a userspace with respect to data in a computing system, wherein the write operations write changes to the data in a filesystem of the computing system;
determining whether the write operations to the filesystem include a request to transmit the data to an IP address, by the process, of a recipient that is unknown or unauthorized and external to both the userspace and the computing system,
wherein the determining comprises monitoring the process and receiving information including the IP address included in the request;
when it is determined that the write operations include the request to transmit the data to the unknown or unauthorized recipient and the IP address is unauthorized, disabling the write operations to the data;
for subsequent requested write operations, logging differentials associated with those subsequent requested write operations, wherein the differentials include changes associated with the write operations; and
alerting a security protocol that the process is a suspected ransomware process.
2 . The method as recited in claim 1 , wherein the process runs in the userspace.
3 . The method as recited in claim 1 , wherein the determining, the disabling, and the logging, are performed in a kernel space.
4 . The method as recited in claim 1 , wherein the suspected ransomware process is determined to be a ransomware process of a type in which data targeted by the ransomware process is first transmitted to an attacker, and then encrypted, by the ransomware process.
5 . The method as recited in claim 1 , wherein when the suspected ransomware process is determined to not be a ransomware process, the differentials are automatically applied to the data in response to a request for the data by a caller.
6 . The method as recited in claim 1 , wherein detecting the write operations comprises monitoring respective inodes of one or more files.
7 . The method as recited in claim 1 , wherein the differentials are logged in a journal outside of the data to which the subsequent requested write operations are directed.
8 . The method as recited in claim 1 , wherein prior to determining whether the write operations include the request to transmit the data, by the process, to the unknown or unauthorized recipient, the data is modified according to prior write operations.
9 . The method as recited in claim 1 , wherein disabling the write operations to the data prevents encryption of the data by the suspected ransomware process.
10 . The method as recited in claim 1 , wherein the data comprises files and/or blocks.
11 . A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
detecting write operations requested by a process operating in a userspace with respect to data in a computing system, wherein the write operations write changes to the data in a filesystem of the computing system;
determining whether the write operations to the filesystem include a request to transmit the data to an IP address, by the process, of a recipient that is unknown or unauthorized and external to both the userspace and the computing system,
wherein the determining comprises monitoring the process and receiving information including the IP address included in the request;
when it is determined that the write operations include the request to transmit the data to the unknown or unauthorized recipient and the IP address is unauthorized, disabling the write operations to the data;
for subsequent requested write operations, logging differentials associated with those subsequent requested write operations, wherein the differentials include changes associated with the write operations; and
alerting a security protocol that the process is a suspected ransomware process.
12 . The non-transitory storage medium as recited in claim 11 , wherein the process runs in the userspace.
13 . The non-transitory storage medium as recited in claim 11 , wherein the determining, the disabling, and the logging, are performed in a kernel space.
14 . The non-transitory storage medium as recited in claim 11 , wherein the suspected ransomware process is determined to be a ransomware process of a type in which data targeted by the ransomware process is first transmitted to an attacker, and then encrypted, by the ransomware process.
15 . The non-transitory storage medium as recited in claim 11 , wherein when the suspected ransomware process is determined to not be a ransomware process, the differentials are automatically applied to the data in response to a request for the data by a caller.
16 . The non-transitory storage medium as recited in claim 11 , wherein the detecting write operations comprises monitoring respective inodes of one or more files.
17 . The non-transitory storage medium as recited in claim 11 , wherein the differentials are logged in a journal outside of the data to which the subsequent requested write operations are directed.
18 . The non-transitory storage medium as recited in claim 11 , wherein prior to determining whether the write operations include the request to transmit the data, by the process, to the unknown or unauthorized recipient, the data is modified according to prior write operations.
19 . The non-transitory storage medium as recited in claim 11 , wherein disabling the write operations to the data prevents encryption of the data by the suspected ransomware process.
20 . The non-transitory storage medium as recited in claim 11 , wherein the data comprises files and/or blocks.