Detecting ransomware

1. A ransomware mitigation engine, comprising:

a processor;

a convolutional neural network configured to provide file type identification (FTI) services comprising:

identifying an access operation of a file as a write to the file or newly creating the file;

computing a byte correlation factor for the file;

classifying the file as belonging to a file type;

determining with a screening confidence that the file type is correct for the file;

determining that the screening confidence is below a screening confidence threshold; and

circuitry and logic to provide heuristic analysis comprising:

receiving notification that the confidence is below the confidence threshold;

performing a statistical analysis of the file to determine a difference between an expected value and a computed value;

determining from the difference, with a detection confidence, that the file has been compromised; and

identifying the file as having been compromised by a ransomware attack.

2. The ransomware mitigation engine of claim 1 , wherein the statistical analysis is selected from the group consisting of entropy, Monte Carlo pi, Monte Carlo pi error, serial correlation coefficient, arithmetic mean, and chi square distribution.

3. The ransomware mitigation engine of claim 2 , wherein determining that the file has been compromised comprises identifying a statistically-significant mismatch in two or more statistical analyses from the group.

4. The ransomware mitigation engine of claim 1 , wherein the CNN is a featureless CNN.

5. The ransomware mitigation engine of claim 1 , further comprising a backup manager configured to create a backup of the file and to restore the file from the backup.

6. The ransomware mitigation engine of claim 5 , wherein the backup is a transitory backup.

7. The ransomware mitigation engine of claim 1 , further comprising a file artefact extractor configured to identify a malicious process according to file artefacts.

8. The ransomware mitigation engine of claim 1 , further comprising a file system input/output filter configured to register file operation hooks with an operating system.

9. The ransomware mitigation engine of claim 1 , further comprising a policy engine configured to apply a remediation policy responsive to the identifying.

10. The ransomware mitigation engine of claim 9 , wherein the policy engine is further configured to identify and remediate a process that instigated the file access operation.

11. The ransomware mitigation engine of claim 1 , wherein the circuitry and logic comprise a processor and one or more tangible, non-transitory computer-readable storage mediums having stored thereon executable instructions to instruct the processor to provide the heuristic layer.

12. The ransomware mitigation engine of claim 1 , wherein the CNN comprises a hardware accelerator.

13. The ransomware mitigation engine of claim 1 , wherein the CNN comprises a field-programmable gate array (FPGA).

14. The ransomware mitigation engine of claim 1 , wherein the CNN comprises a bank of GPUs.

15. The ransomware mitigation engine of claim 1 , wherein the CNN comprises an ASIC.

16. One or more tangible, non-transitory computer-readable storage mediums having stored thereon executable instructions to program or configure a logic device to provide a ransomware mitigation engine, the ransomware mitigation engine to:

identify an access operation of a file as a write to the file or newly creating the file;

operate a convolutional neural network (CNN) file type identification (FTI) layer to determine with a screening confidence that the file type is correct for the file, and that the screening confidence is below a screening confidence threshold;

perform a statistical analysis of the file to determine a difference between an expected value and a computed value; determine from the difference that the file has been compromised and that the file has been compromised by ransomware.

17. The one or more tangible, non-transitory computer-readable mediums of claim 16 , wherein the instructions are further to provide a file artefact extractor to identify a malicious process according to file artefacts.

18. The one or more tangible, non-transitory computer-readable mediums of claim 16 , further comprising instructions to program the logic device to provide the CNN, wherein the CNN is to compute a byte correlation for the file and classify the file as belonging to a file type according to the byte correlation.

19. A method of detecting and remediating a ransomware attack, comprising:

operating a neural network to compute a byte correlation factor for a file under inspection;

classifying the file under inspection as belonging to a file type according to the byte correlation;

determine that the file type is incorrect for the file under inspection;

performing a statistical analysis of the file under inspection to determine a difference between an expected value and a computed value; and

determining from the difference that the file under inspection has been compromised by a ransomware attack.

20. The method of claim 19 , wherein the statistical analysis is selected from the group consisting of entropy, Monte Carlo pi, Monte Carlo pi error, serial correlation coefficient, arithmetic mean, and chi square distribution.