Detection and recovery from ransomware infections
Systems and techniques are described to detect and recover from ransomware infections. It may be determined if a ransomware attack is in progress based on analyzing read and write requests to a file system. Next, a mitigation action may be performed in response to determining that a ransomware attack is in progress.
1. A method, comprising:
determining, by a processor, whether a ransomware attack is in progress based on analyzing read and write requests to a file system, wherein said analyzing comprises (1) calculating a ratio of a count of read requests to a count of write requests received from a client, (2) ranking clients in decreasing order based on counts of write requests received from the clients over a time interval, and (3) detecting an increase in a rank of the client which is greater than a threshold; and
performing a mitigation action in response to determining that a ransomware attack is in progress.
2. The method of claim 1 , wherein said analyzing read and write requests to the file system comprises calculating an entropy of a file block associated with a write request.
3. The method of claim 1 , wherein said analyzing read and write requests to the file system comprises calculating a compression ratio for compressing a file block associated with a write request.
4. The method of claim 1 , wherein said analyzing read and write requests to the file system comprises detecting a write request for a canary file.
5. The method of claim 1 , wherein said performing the mitigation action comprises generating an alert.
6. The method of claim 1 , wherein said performing the mitigation action comprises storing an unmodified version of a file block associated with a write request.
7. The method of claim 1 , wherein said performing the mitigation action comprises reducing a rate at which read and write requests are processed for a client associated with the ransomware attack.
8. The method of claim 1 , wherein said performing the mitigation action comprises disconnecting a client associated with the ransomware attack.
9. A non-transitory computer-readable storage medium storing instructions that, when executed by a processor, cause the processor to:
determine whether a ransomware attack is in progress based on analyzing read and write requests to a file system, wherein said analyzing comprises (1) detecting a write request for a canary file, wherein the canary file is not expected to be accessed by a client, (2) calculating a ratio of a count of read requests to a count of write requests received from the client, (3) ranking clients in decreasing order based on counts of write requests received from the clients over a time interval, and (4) detecting an increase in a rank of the client which is greater than a threshold; and
perform a mitigation action in response to determining that a ransomware attack is in progress.
10. The non-transitory computer-readable storage medium of claim 9 , wherein said analyzing read and write requests to the file system comprises calculating an entropy of a file block associated with a write request.
11. The non-transitory computer-readable storage medium of claim 9 , wherein said analyzing read and write requests to the file system comprises calculating a compression ratio for compressing a file block associated with a write request.
12. The non-transitory computer-readable storage medium of claim 9 , wherein said performing the mitigation action comprises generating an alert.
13. The non-transitory computer-readable storage medium of claim 9 , wherein said performing the mitigation action comprises storing an unmodified version of a file block associated with a write request.
14. The non-transitory computer-readable storage medium of claim 9 , wherein said performing the mitigation action comprises reducing a rate at which read and write requests are processed for a client associated with the ransomware attack, or disconnecting the client associated with the ransomware attack.
15. An apparatus, comprising:
a memory storing instructions; and
a processor, coupled to the memory and to execute the instructions, the instructions when executed cause the processor to:
determine whether a ransomware attack is in progress based on analyzing read and write requests to a file system, wherein said analyzing comprises (1) calculating a ratio of a count of read requests to a count of write requests received from a client, (2) ranking clients in decreasing order based on counts of write requests received from the clients over a time interval, and (3) detecting an increase in a rank of the client which is greater than a threshold; and
perform a mitigation action in response to determining that a ransomware attack is in progress.