Detecting ransomware based on file comparisons
An anti-malware application detects and remediates ransomware. The anti-malware application monitors processes executing on a computing device and detects that a process is opening a file for editing. A portion of the original file is saved prior to being edited by the process. Once the edited file is saved, the anti-malware application compares a portion of the edited file to the portion of the original file to determine if the edited file is encrypted. The anti-malware application may determine the process is associated with ransomware based on whether the edited file is encrypted.
1. A method for detecting ransomware comprising:
monitoring a process executing on a computing device;
detecting, by a processor, an opening of an original file by the process for editing;
responsive to detecting the opening of the original file by the process for editing, saving a portion of the original file prior to the original file being edited by the process;
detecting, by the processor, saving of an edited file, corresponding to the original file edited by the process;
responsive to detecting the saving of the edited file, dividing the portion of the edited file into chunks;
dividing the portion of the original file into chunks corresponding to the chunks of the edited file;
performing comparisons between chunk pairs, each comprising a chunk of the original file and a corresponding chunk of the edited file;
determining respective difference measures for each of the chunk pairs based on the comparisons;
determining chunk pairs that have difference measures meeting a modification threshold;
calculating one or more entropy parameters representing an average of entropy differences between respective chunks in each of the chunk pairs that have the difference measures meeting the modification threshold;
determining, by the processor, whether the edited file is encrypted based on the one or more entropy parameters;
determining if the process corresponds to the ransomware based on detecting that the edited file is encrypted; and
responsive to determining that the process corresponds to the ransomware, remediating the process.
2. The method of claim 1 , further comprising
applying a machine-learned model to the one or more entropy parameters to detect encryption indicative of ransomware.
3. The method of claim 1 , wherein determining the chunk pairs that meet the modification threshold comprises:
performing a byte-wise comparison between respective bytes of chunks in each of the chunk pairs to determine a count of differences; and
responsive to determining that the count of differences for a given chunk pair exceeds a threshold count, determining that the given chunk pair meets the modification threshold.
4. The method of claim 1 , wherein calculating the one or more entropy parameters comprises:
calculating one or more pairs of entropy values for respective chunks in each of the chunk pairs;
calculating entropy differences between each of the one or more pairs of entropy values in each of the chunk pairs; and
averaging the entropy differences for each of the one or more types of entropy measures to generate the one or more entropy parameters.
5. The method of claim 4 , wherein calculating the one or more pairs of entropy values comprises:
calculating a plurality of different pairs of entropy values using different entropy calculation algorithms.
6. The method of claim 1 , wherein determining, by the processor,
whether the edited file is encrypted is further based on at least one of:
a compression percentage of the edited file to the original file,
a value indicating whether a size of the edited file is a multiple of a predefined size, and
whether the edited file includes a ransomware file header included in a blacklist.
7. The method of claim 1 , further comprising:
responsive to determining that the process is on a whitelist of known processes that are not ransomware, removing the process from the whitelist, wherein monitoring the process executing on a computing device comprises monitoring processes that are not on the whitelist.
8. The method of claim 1 , further comprising:
determining if the process does not correspond to ransomware based on detecting that the edited file is unencrypted; and
responsive to determining that the process does not correspond to ransomware, placing the process on a whitelist of known processes that are not ransomware, wherein monitoring the process executing on a computing device comprises monitoring processes that are not on the whitelist.
9. The method of claim 8 , wherein determining that the process does not correspond to ransomware comprises determining that the process does not encrypt greater than a threshold number of files that the process has opened for editing.
10. The method of claim 1 , wherein monitoring the process executing on a computing device comprises:
determining if the process is safe based on at least one of:
(a) determining if the process is a system protected file,
(b) determining if the process is on a whitelist of known processes that are not ransomware,
(c) determining if the process is digitally signed by a trusted source, and
(d) determining if an age of the process exceeds a threshold age;
and
wherein detecting the opening of the original file is performed responsive to failing to determine that the process is safe.
11. The method of claim 1 , wherein determining if the process corresponds to the ransomware based on detecting that the edited file is encrypted comprises:
responsive to determining that the edited file is encrypted by the process, storing a new indicator associated with the detecting that the edited file is encrypted to a log in a storage device, the log storing a plurality of past indicators for respectively detected behaviors of the process, and the log storing respective scores for the new indicator and the plurality of past indicators;
generating a running score for the process by combining the respective scores of the plurality of past indicators and the new indicator associated with the process in the log;
determining that the running score for the process exceeds a predefined threshold score; and
responsive to determining that the running score exceeds the predefined threshold score, determining that the process corresponds to the ransomware.
12. A non-transitory computer-readable storage medium storing instructions for detecting ransomware, the instructions when executed by a processor cause the processor to perform steps including:
monitoring a process executing on a computing device;
detecting, by a processor, an opening of an original file by the process for editing;
responsive to detecting the opening of the original file by the process for editing, saving a portion of the original file prior to the original file being edited by the process;
detecting, by the processor, saving of an edited file, corresponding to the original file edited by the process;
responsive to detecting the saving of the edited file, dividing the portion of the edited file into chunks;
dividing the portion of the original file into chunks corresponding to the chunks of the edited file;
performing comparisons between chunk pairs, each comprising a chunk of the original file and a corresponding chunk of the edited file;
determining respective difference measures for each of the chunk pairs based on the comparisons;
determining chunk pairs that have difference measures meeting a modification threshold;
calculating one or more entropy parameters representing an average of entropy differences between respective chunks in each of the chunk pairs that have the difference measures meeting the modification threshold;
determining, by the processor, whether the edited file is encrypted based on the one or more entropy parameters;
determining if the process corresponds to the ransomware based on detecting that the edited file is encrypted; and
responsive to determining that the process corresponds to the ransomware, remediating the process.
13. The non-transitory computer-readable storage medium of claim 12 , the instructions further including
applying a machine-learned model to the one or more entropy parameters to detect encryption indicative of ransomware.
14. The non-transitory computer-readable storage medium of claim 12 , wherein determining the chunk pairs that meet the modification threshold comprises:
performing a byte-wise comparison between respective bytes of chunks in each of the chunk pairs to determine a count of differences; and
responsive to determining that the count of differences for a given chunk pair exceeds a threshold count, determining that the given chunk pair meets the modification threshold.
15. The non-transitory computer-readable storage medium of claim 12 , wherein calculating the one or more entropy parameters comprises:
calculating one or more pairs of entropy values for respective chunks in each of the chunk pairs;
calculating entropy differences between each of the one or more pairs of entropy values in each of the chunk pairs; and
averaging the entropy differences for each of the one or more types of entropy measures to generate the one or more entropy parameters.
16. The non-transitory computer-readable storage medium of claim 15 , wherein calculating the one or more pairs of entropy values comprises:
calculating a plurality of different entropy values using different entropy calculation algorithms.
17. A computing system comprising:
a processor; and
a non-transitory computer-readable storage medium storing instructions for detecting ransomware, the instructions when executed by the processor cause the processor to perform steps including:
monitoring a process executing on a computing device;
detecting, by a processor, an opening of an original file by the process for editing;
responsive to detecting the opening of the original file by the process for editing, saving a portion of the original file prior to the original file being edited by the process;
detecting, by the processor, saving of an edited file, corresponding to the original file edited by the process;
responsive to detecting the saving of the edited file, dividing the portion of the edited file into chunks;
dividing the portion of the original file into chunks corresponding to the chunks of the edited file;
performing comparisons between chunk pairs, each comprising a chunk of the original file and a corresponding chunk of the edited file;
determining respective difference measures for each of the chunk pairs based on the comparisons;
determining chunk pairs that have difference measures meeting a modification threshold;
calculating one or more entropy parameters representing an average of entropy differences between respective chunks in each of the chunk pairs that have the difference measures meeting the modification threshold;
determining, by the processor, whether the edited file is encrypted based on the one or more entropy parameters;
determining if the process corresponds to the ransomware based on detecting that the edited file is encrypted; and
responsive to determining that the process corresponds to the ransomware, remediating the process.
18. The computing system of claim 17 , the instructions further including
applying a machine-learned model to the one or more entropy parameters to detect encryption indicative of ransomware.
19. The computing system of claim 17 , wherein determining the chunk pairs that meet the modification threshold comprises:
performing a byte-wise comparison between respective bytes of chunks in each of the chunk pairs to determine a count of differences; and
responsive to determining that the count of differences for a given chunk pair exceeds a threshold count, determining that the given chunk pair meets the modification threshold.
20. The computing system of claim 18 , wherein calculating the one or more entropy parameters comprises:
calculating one or more pairs of entropy values for respective chunks in each of the chunk pairs;
calculating entropy differences between each of the one or more pairs of entropy values in each of the chunk pairs; and
averaging the entropy differences for each of the one or more types of entropy measures to generate the one or more entropy parameters.