Advanced ransomware detection
Methods, apparatuses and computer program products implement embodiments of the present invention that include protecting a computer system coupled to a storage device by detecting an executing process that performed a specific type of modification to a number of files stored on the storage device. A processor compares the detected number to a specified threshold and initiates, on the executing process, a preventive action in response to determining that the detected number exceeds the specified threshold.
1. A method for protecting a computer system coupled to a storage device, comprising:
specifying one or more original file extensions that are applied in naming files that store documents, spreadsheets, or images;
detecting an executing process that performed a specific type of modification to a number of files stored on the storage device, wherein the specific type of modification includes renaming respective file extensions of the files having one of the specified original file extensions from the one of the specified original file extensions to a new file extension;
comparing, by a processor, the detected number of files to a specified threshold; and
initiating, on the executing process, a preventive action in response to determining that the detected number exceeds the specified threshold,
wherein initiating the preventive action comprises identifying a causality chain for the executing process by analyzing a context of a thread of the executing process that was found to be malicious, applying the analyzed context to identify additional malicious threads in the causality chain, and applying the preventive action to all the identified threads in the causality chain.
2. The method according to claim 1 , wherein initiating the preventive a comprises terminating the executing process and the threads in the causality chain.
3. The method according to claim 1 , wherein the specific type of modification comprises renaming the file extensions of the files to identical file extensions.
4. The method according to claim 1 , wherein the specific type of modification comprises encrypting the files.
5. The method according to claim 4 , wherein detecting the executing process comprises parsing headers of the files to detect that the files have been encrypted.
6. An apparatus for protecting a computer system, comprising:
a storage device configured to store a plurality of files;
a memory; and
a processor configured:
to receive one or more specified original file extensions that are applied in naming files that store documents, spreadsheets, or images,
to detect, in the memory, an executing process that performed a specific type of modification to a number of files stored on the storage device, wherein the specific type of modification includes renaming respective file extensions of the files having one of the specified original file extensions from the one of the specified original file extensions to a new file extension,
to compare, the detected number of files to a specified threshold; and
to initiate, on the executing process, a preventive action in response to determining that the detected number exceeds the specified threshold,
wherein the processor is configured to initiate the preventive action by identifying a causality chain for the executing process by analyzing a context of a thread of the executing process that was found to be malicious, applying the analyzed context to identify additional malicious threads in the causality chain, and applying the preventive action to all the identified threads in the causality chain.
7. The apparatus according to claim 6 , wherein the preventive action comprises terminating the executing process and the threads in the causality chain.
8. The apparatus according to claim 6 , wherein the specific type of modification comprises renaming the file extensions of the files to identical file extensions.
9. The apparatus according to claim 6 , wherein the specific type of modification comprises encrypting the files.
10. The apparatus according to claim 9 , wherein the processor is configured to detect the executing process by parsing headers of the files to detect that the files have been encrypted.
11. A computer software product for protecting a computing system, the product comprising a non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a computer, cause the computer:
to receive one or more specified original file extensions that are applied in naming files that store documents, spreadsheets, or images;
to detect an executing process that performed a specific type of modification to a number of files stored on a storage device, wherein the specific type of modification includes renaming respective file extensions of the files having one of the specified original file extensions from the one of the specified original file extensions to a new file extension;
to compare the detected number of files to a specified threshold; and
to initiate, on the executing process, a preventive action in response to determining that the detected number exceeds the specified threshold,
wherein the instructions cause the computer to initiate the preventive action by identifying a causality chain for the executing process by analyzing a context of a thread of the executing process that was found to be malicious, applying the analyzed context to identify additional malicious threads in the causality chain, and applying the preventive action to all the identified threads in the causality chain.
12. The product according to claim 11 , wherein the specific type of modification comprises renaming the file extensions of the files to identical file extensions.
13. The product according to claim 11 , wherein the specific type of modification comprises encrypting the files.
14. The product according to claim 13 , wherein the instructions cause the computer to detect the executing process by parsing headers of the files to detect that the files have been encrypted.