Anti-ransomware systems and methods using a sinkhole at an electronic device

1. A malware scanner to scan computer files, the malware scanner comprising:

at least one storage device; and

at least one processor, wherein the at least one processor is to implement:

a sinkhole generator to generate a sinkhole directory,

wherein the sinkhole directory is to recursively expand when a computer file performs a file listing of the sinkhole directory to occupy the computer file by extending a period of time taken to perform the file listing of the sinkhole directory, and

wherein the sinkhole generator is to generate the sinkhole directory to include a canary file to be processed and to include a recursive junction to point back to the sinkhole directory, the recursive junction to include a plurality of recursive file system mount points to recursively direct a process associated with the computer file to process the canary file;

an analyzer to monitor execution of the computer file while the computer file is performing the file listing of the sinkhole directory to attempt to identify an indicator of compromise associated with the computer file, the analyzer to classify the computer file as ransomware when the analyzer identifies the indicator of compromise; and

a cleaner to remediate the ransomware,

wherein the sinkhole generator, the analyzer, and the cleaner are implemented using software and executed by the at least one processor.

2. The malware scanner of claim 1 , wherein the cleaner is to interrupt the execution of the computer file when the computer file is identified as ransomware.

3. The malware scanner of claim 1 , wherein the indicator of compromise includes at least one of a file access, a resource usage, a file system access, or a directory processing.

4. The malware scanner of claim 1 , wherein the sinkhole generator is to generate the sinkhole directory at least one of a) on demand or b) continuously.

5. At least one non-transitory machine-readable medium comprising instructions which, when executed, cause at least one processor to at least:

spawn a sinkhole directory to recursively expand when a file index of the sinkhole directory is performed to extend a period of time taken for a computer file to perform the file index of the sinkhole directory, the sinkhole directory to include a canary file to be processed and to include a recursive junction to point back to the sinkhole directory, the recursive junction to include a plurality of recursive file system mount points to recursively direct a process associated with the computer file to process the canary file;

identify the computer file as ransomware in response to a presence of an indicator of compromise associated with execution of the computer file; and

remediate the ransomware.

6. The at least one non-transitory machine-readable medium of claim 5 , wherein the instructions, when executed, further cause the at least one processor to remediate the ransomware by interrupting the execution of the computer file when the computer file is identified as ransomware.

7. The at least one non-transitory machine-readable medium of claim 5 , wherein the indicator of compromise includes at least one of a file access, a resource usage, a file system access, or a directory processing.

8. The at least one non-transitory machine-readable medium of claim 5 , wherein the instructions, when executed, cause the at least one processor to spawn the sinkhole directory at least one of a) on demand or b) continuously.

9. A method to remediate ransomware on an electronic device, the method comprising:

generating, by executing an instruction with at least one processor, a sinkhole directory, the sinkhole directory to recursively expand when a computer file performs a file listing of the sinkhole directory to delay the computer file by extending a period of time to perform the file listing, the generating of the sinkhole directory including generating a canary file and a recursive junction in the sinkhole directory, the recursive junction to include a plurality of recursive file system mount points to recursively direct a process associated with the computer file to process the canary file;

monitoring, by executing an instruction with the at least one processor, execution of the computer file while the computer file is performing the file listing of the sinkhole directory to attempt to identify an indicator of compromise associated with the computer file;

classifying, by executing an instruction with the at least one processor, the computer file as ransomware in response to identification of the indicator of compromise; and

remediating the ransomware by executing an instruction with the at least one processor.

10. The method of claim 9 , further including interrupting the execution of the computer file in response to the identification of the computer file as ransomware.

11. The method of claim 9 , wherein the indicator of compromise includes at least one of a file access, a resource usage, a file system access, or a directory processing.

12. The method of claim 9 , wherein the generating of the sinkhole directory is performed at least one of a) on demand or b) continuously.