Mitigation of ransomware
Particular embodiments described herein provide for an electronic device that can be configured to allow for the mitigation of ransomware. For example, the system can determine that an application begins to execute, determine that the application attempts to modify a file, determine a file type for the file, and create a security event if the application is not authorized to modify the file type. In another example, the system determines an entropy value between the file and the attempted modification of the file, and create a security event if the entropy value satisfies a threshold or determine a system entropy value that includes a rate at which other files on the system are being modified by the application, and create a security event if the system entropy value satisfies a threshold.
1. At least one non-transitory computer-readable medium comprising one or more instructions that when executed by at least one processor, cause the at least one processor to:
determine that an application on a system begins to execute;
determine that the application accesses and attempts to modify a file on the system;
determine an entropy value that includes a rate at which the file is being modified by the application, wherein the entropy value is based on a random number of blocks at random locations in the file; and
create a security event based on a determination that the entropy value satisfies a threshold.
2. The at least one computer-readable medium of claim 1 , wherein the entropy value represents the rate at which the file is being modified by the application over a time period, and wherein the time period is the time since the last operating system (OS) boot, or the time period since the file was created or last modified.
3. The at least one computer-readable medium of claim 1 , further comprising one or more instructions that when executed by the at least one processor, further cause the processor to:
determine if the application is not authorized to modify the file based on an access control list that includes a list of files that the application is authorized to modify.
4. The at least one computer-readable medium of claim 1 , further causing the at least one processor to:
determine a system entropy value that includes a rate at which other files on the system are being modified by the application, wherein the other files on the system used to determine the system entropy value are chosen randomly and are monitored for modification by the application; and
create a security event based on a determination that the system entropy value satisfies a threshold.
5. An apparatus comprising:
a memory element operable to store instructions; and
a processor operable to execute the instructions, such that the apparatus is configured to:
determine that an application on a system begins to execute;
determine that the application accesses and attempts to modify a file on the system;
determine an entropy value that includes a rate at which the file is being modified by the application, wherein the entropy value is based on a random number of blocks at random locations in the file; and
create a security event based on a determination that the system entropy value satisfies a threshold.
6. The apparatus of claim 5 , further comprising:
determine if the application is not authorized to modify the file based on an access control list that includes a list of files that the application is authorized to modify.
7. The apparatus of claim 4 , wherein the entropy value represents the rate at which the file is being modified by the application over a time period, and wherein the time period is the time since the last operating system (OS) boot, or the time period since the file was created or last modified.
8. The apparatus of claim 4 , further configured to:
determine a system entropy value that includes a rate at which other files on the system are being modified by the application, wherein the other files on the system used to determine the system entropy value are chosen randomly and are monitored for modification by the application; and
create a security event based on a determination that the system entropy value satisfies a threshold.
9. A method comprising:
determining that an application on a system begins to execute;
determining that the application accesses and attempts to modify a file on the system;
determining an entropy value that includes a rate at which the file is being modified by the application, wherein the entropy value is based on a random number of blocks at random locations in the file; and
creating a security event based on a determination that the system entropy value satisfies a threshold.
10. The method of claim 9 , further comprising:
determining if the application is not authorized to modify the file based on an access control list that includes a list of files that the application is authorized to modify.
11. The method of claim 9 , wherein the entropy value represents the rate at which the file is being modified by the application over a time period, and wherein the time period is the time since the last operating system (OS) boot, or the time period since the file was created or last modified.
12. The method of claim 9 , further comprising:
determining a system entropy value that includes a rate at which other files on the system are being modified by the application, wherein the other files on the system used to determine the system entropy value are chosen randomly and are monitored for modification by the application; and
creating a security event based on a determination that the system entropy value satisfies a threshold.
13. A system for the mitigation of ransomware, the system comprising:
a security engine, comprising:
a processor; and
a memory storing executable instructions that when executed by the processor cause the processor to:
determine that an application on a system begins to execute;
determine that the application accesses and attempts to modify a file on the system;
determine an entropy value that includes a rate at which the file is being modified by the application, wherein the entropy value is based on a random number of blocks at random locations in the file; and
create a security event based on a determination that the entropy value satisfies a threshold.
14. The system of claim 13 , further comprising:
determine if the application is not authorized to modify the file based on an access control list that includes a list of files that the application is authorized to modify.
15. The system of claim 13 , wherein the entropy value represents the rate at which the file being modified by the application over a time period, and wherein the time period is the time since the last operating system (OS) boot, or the time period since the file was created or last modified.
16. The system of claim 13 , further comprising:
determine a system entropy value that includes a rate at which other files on the system are being modified by the application, wherein the other files on the system used to determine the system entropy value are chosen randomly and are monitored for modification by the application; and
create a security event based on a determination that the system entropy value satisfies a threshold.