Granted Patent B2

US 12,284,206 · App. 17/537,433 · Granted Apr 22, 2025

Inventors: Sean Hittel (Calgary, CA); Krishna Narayanaswamy (Saratoga, CA); Ravindra K. Balupari (San Jose, CA); Ravi Ithal (Fremont, CA)

Assignee: Netskope, Inc.

H04L63/145G06F16/907G06F21/552G06F21/565H04L63/1433G06F21/566G06F2221/2101

Abstract

Claims (97)

1. A method of detecting a ransomware attack impacting a cloud-based file storage service, the method comprising:

collecting metadata on files stored on the cloud-based file storage service, wherein:

the collecting the metadata comprises:

collecting a first portion of the metadata using an inspective agent of a proxy device through an application programming interface to the cloud-based file storage service; and

collecting a second portion of the metadata using a client agent installed locally on client devices that manipulate the files stored on the cloud-based file storage service,

the cloud-based file storage service supports manipulation by creating, editing, and sharing the files, and

the collected metadata includes at least one of an extension of a file name, a magic number, and a size;

storing the collected metadata as historical metadata in a historical metadata storage, wherein the historical metadata storage is separate from and not under control of the cloud-based file storage service;

detecting multiple artifacts of the ransomware attack resulting from ransomware manipulation of the files, the detecting including:

comparing at least one of the extension, the magic number and the size included in the historical metadata to at least one of the extension, the magic number and the size included in current metadata of the files to identify a volume of changes in the files, and

detecting that the identified volume of changes exceeds a predetermined change volume to determine that the ransomware attack is in progress;

identifying a user and/or client device of the client devices that manipulated the files exhibiting the multiple artifacts; and

responding to the determination that the ransomware attack is in progress, wherein the responding comprises:

restricting further manipulation of other files on the cloud-based file storage service by the identified user and/or client device.

2. The method of claim 1 , wherein;

the collecting the metadata further comprises collecting a third portion of the metadata using an active agent of the proxy device; and

the proxy device is positioned between the client devices and the cloud-based file storage service.

3. The method of claim 1 , wherein the responding further comprises:

notifying the user and/or client device that the ransomware attack was detected; and

providing a location of the ransomware attack to the user and/or client device.

4. The method of claim 1 , wherein the responding further comprises:

isolating the cloud-based file storage service, the isolating comprising:

disconnecting the identified user and/or client device from the cloud-based file storage service, and

disconnecting additional users who have access to the cloud-based file storage service; and

preventing the identified user and/or client device from accessing the cloud-based file storage service.

5. The method of claim 1 , wherein the responding further comprises at least one of performing a backup of the files and performing a backup of the cloud-based file storage service on which the files are stored.

6. The method of claim 1 , wherein the responding further comprises:

forcing the identified user and/or client device to perform a local scan for the ransomware attack; forcing a scan for the ransomware attack on any other cloud-based file storage service for which the identified user and/or client device has access;

forcing additional users who have access to the cloud-based file storage service to perform the local scan for the ransomware attack; and

forcing a scan for the ransomware attack on any other cloud-based file storage service for which the additional users have access.

7. The method of claim 1 , wherein:

the responding further comprises restoring a previous backup of the cloud-based file storage service; and

the restoring of the previous backup is automated or performed with user interaction.

8. The method of claim 1 , wherein the responding further comprises:

determining a creator of a file having caused the ransomware attack to be initiated on the identified user and/or client device based on the current metadata and the historical metadata; and

identifying and performing a specific response mechanism of multiple response mechanisms based on the determined creator.

9. A method of detecting a ransomware attack impacting a cloud-based file storage service, the method comprising:

collecting content properties from payloads of files stored on the cloud-based file storage service, wherein:

the collecting the content properties comprises:

collecting a first portion of the content properties using an inspective agent of a proxy device through an application programming interface to the cloud-based file storage service; and

collecting a second portion of the content properties using a client agent installed locally on client devices that manipulate the files stored on the cloud-based file storage service,

the cloud-based file storage service supports manipulation by creating, editing, and sharing the files, and

the collected content properties include at least one of a computed entropy or layered entropy, a locality-sensitive hashing (LSH), and an indication of an occurrence of a stub;

storing the collected content properties as historical content properties in a historical content properties storage, wherein the historical content properties storage is separate from and not under control of the cloud-based file storage service;

detecting multiple artifacts of the ransomware attack resulting from ransomware manipulation of the files, the detecting including:

comparing at least one of the computed entropy or layered entropy, the LSH, and the indication of the occurrence of the stub included in the historical content properties to respective at least one of the computed entropy or layered entropy, the LSH, and the indication of the occurrence of the stub included in current content properties of the files to identify a volume of changes in the files, and

detecting that the identified volume of changes exceeds a predetermined change volume to determine that the ransomware attack is in progress;

identifying a user and/or client device of the client devices that manipulated the files exhibiting the multiple artifacts; and

responding to the determination that the ransomware attack is in progress, the responding comprising:

restricting further manipulation of other files on the cloud-based file storage service by the identified user and/or client device.

10. The method of claim 9 , wherein:

the collecting the content properties further comprises collecting a third portion of the content properties using an active agent of the proxy device; and

the proxy device is positioned between the client devices and the cloud-based file storage service.

11. The method of claim 9 , wherein the identified volume of changes are identified by determining a hamming distance between the LSH for the current content properties and the LSH for the historical content properties.

12. The method of claim 9 , wherein the responding further comprises:

calculating an entropy of the payloads of the files;

comparing the entropy of the payloads of the files with entropies of known user-initiated encryption techniques to determine whether or not the identified user and/or client device has implemented a user-initiated encryption technique;

identifying each of the files for which the identified user and/or client device has implemented the user-initiated encryption technique;

determining that the ransomware attack is in process by analyzing the current content properties of the files and the historical content properties of the files, excluding the files for which the identified user and/or client device has implemented the user-initiated encryption technique, to identify the volume of changes between the current content properties and the historical content properties of the files that exceeds the predetermined change volume; and

determining that the ransomware attack is in process by analyzing (i) the current content properties of the files, excluding the files for which the identified user and/or client device has implemented the user-initiated encryption technique, and (ii) known patterns of malicious content properties that indicate a known malicious file modification to identify a match between the current content properties of the files, excluding the files for which the identified user and/or client device has implemented the user-initiated encryption technique, and the known patterns of malicious content properties.

13. A method of detecting a ransomware attack impacting a cloud-based file storage service, the method comprising:

collecting metadata on files stored on the cloud-based file storage service, wherein:

the collecting the metadata comprises:

collecting a first portion of the metadata using an inspective agent of a proxy device through an application programming interface to the cloud-based file storage service; and

collecting a second portion of the metadata using a client agent installed locally on client devices that manipulate the files stored on the cloud-based file storage service,

the cloud-based file storage service supports manipulation by creating, editing, and sharing the files, and

the collected metadata includes at least one of an extension of a file name, a magic number, and a size;

storing the collected metadata as historical metadata in a historical metadata storage, wherein the historical metadata storage is separate from and not under control of the cloud-based file storage service;

detecting multiple artifacts of the ransomware attack resulting from ransomware manipulation of the files, the detecting including:

determining whether the historical metadata exists for the files and a pattern of current metadata for the files, and

determining that the ransomware attack is in progress when (i) the historical metadata does not exist for one or more of the files and (ii) the pattern of the current metadata of the one or more of the files corresponds to a known pattern of malicious metadata;

identifying a user and/or client device of the client devices that manipulated the files exhibiting the multiple artifacts; and

responding to the detection of the ransomware attack, the responding comprising:

restricting further manipulation of other files on the cloud-based file storage service by the identified user and/or client device.

14. The method of claim 13 , wherein the responding further comprises:

notifying the user and/or client device that the ransomware attack is in progress; and

providing a location of the ransomware attack to the user and/or client device.

15. The method of claim 13 , wherein the responding further comprises:

isolating the cloud-based file storage service the isolating comprising:

disconnecting the identified user and/or client device from the cloud-based file storage service, and

disconnecting additional users who have access to the cloud-based file storage service; and

preventing the identified user and/or client device from accessing the cloud-based file storage service.

16. The method of claim 13 , wherein the responding further comprises at least one of performing a backup of the files and performing a backup of the cloud-based file storage service on which the files are stored.

17. The method of claim 13 , wherein the responding further comprises:

forcing the identified user and/or client device to perform a local scan for the ransomware attack;

forcing a scan for the ransomware attack on any other cloud-based file storage service for which the identified user and/or client device has access;

forcing additional users who have access to the cloud-based file storage service to perform the local scan for the ransomware attack; and

forcing a scan for the ransomware attack on any other cloud-based file storage service for which the additional users have access.

18. The method of claim 13 , wherein:

the responding further comprises restoring a previous backup of the cloud-based file storage service; and

the restoring of the previous backup is automated or performed with user interaction.

19. The method of claim 13 , wherein the responding further comprises:

determining a creator of a file having caused the ransomware attack to be initiated on the identified user and/or client device based on the current metadata and the historical metadata; and

identifying and performing a specific response mechanism of multiple response mechanisms based on the determined creator.

20. The method of claim 13 , wherein:

the collecting the metadata further comprises collecting a third portion of the metadata using an active agent of the proxy device; and

the proxy device is positioned between the client devices and the cloud-based file storage service.

Assignments (3)

Continuity (4)

References Cited (164)