Ransomware attack onset detection
A method of detecting the onset of a ransomware attack is presented. In an example embodiment, file backup metadata for each of a plurality of computing devices is accessed and analyzed to detect anomalous file backup activity of individual ones of the computing devices. A determination is made as to whether the detected anomalous file backup activity of at least some of the computing devices is correlated in time. File description metadata for each of the computing devices is also accessed and analyzed to identify files in the computing devices that are anomalous to other files in the computing devices. A determination whether a ransomware attack has begun is based on a determination that the detected anomalous file backup activity of at least some of the computing devices is correlated in time, as well as on the identified anomalous files.
1 . A method for detecting a ransomware attack, the method comprising:
accessing file backup metadata for a first computing device and a second computing device;
analyzing, using at least one hardware processor of a machine, the file backup metadata to detect first anomalous file backup activity at the first computing device and second anomalous file backup activity at the second computing device, wherein the first anomalous file backup activity has an associated first detected time and the second anomalous file backup activity has an associated second detected time;
determining that the first anomalous file backup activity and the second anomalous file backup activity are correlated based on the first anomalous file backup activity and the second anomalous file backup activity, wherein determining that the first anomalous file backup activity is correlated with the second anomalous file backup activity comprises determining that the second detected time is within a predetermined time period of the first detected time;
accessing file description metadata for the first computing device and the second computing device;
analyzing the file description metadata to identify anomalous files at the first computing device and the second computing device; and
determining that a ransomware attack has begun based on the determination that the first anomalous file backup activity and the second anomalous file backup activity are correlated, and based on the identified anomalous files at the first computing device and the second computing device.
2 . The method of claim 1 , further comprising:
accessing file backup metadata for a third computing device;
analyzing the file backup metadata for the third computing device to detect third anomalous file backup activity at the third computing device;
determining that the third anomalous file backup activity is correlated with the first anomalous file backup activity and the second anomalous file backup activity;
accessing file description metadata for the third computing device;
analyzing the file description metadata for the third computing device to identify anomalous files at the third computing device; and
wherein the determination that a ransomware attack has begun is further based on the determination that the third anomalous file backup activity is correlated in time with the first anomalous file backup activity and the second anomalous file backup activity, and further based on the identified anomalous files at the third computing device.
3 . The method of claim 1 , wherein the file description metadata comprises file extensions, wherein analyzing the file description metadata to identify anomalous files at the first computing device and the second computing device comprises determining file extensions of the anomalous files at the first computing device are different than file extensions of other files at the first computing device and that file extensions of the anomalous files at the second computing device are different than file extensions of other files at the second computing device.
4 . The method of claim 1 , wherein the file description metadata comprises at least one of a filename, a file MIME type, a file size, a file hash, and a time of file creation, reading, updating, or deletion.
5 . The method of claim 1 , wherein analyzing the file description metadata comprises identifying a first file on the first computing device as being anomalous based on the first file having the same filename and at least one of a different file extension and a different MIME type as a second file on the second computing device, wherein the second file has been identified as anomalous.
6 . The method of claim 1 , wherein the first anomalous file backup activity comprises a change in file backup activity of a file backup operation at the first computing device compared to a plurality of other file backup operations at the first computing device.
7 . A system comprising:
one or more hardware processors; and
a memory storing instructions that, when executed by the one or more hardware processors, cause the system to perform operations comprising:
accessing file backup metadata for a first computing device and a second computing device;
analyzing the file backup metadata to detect first anomalous file backup activity at the first computing device and second anomalous file backup activity at the second computing device, wherein the first anomalous file backup activity has an associated first detected time and the second anomalous file backup activity has a second detected time;
determining that the first anomalous file backup activity and the second anomalous file backup activity are correlated based on the first anomalous file backup activity and the second anomalous file backup activity, wherein determining that the first anomalous file backup activity is correlated with the second anomalous file backup comprises determining that the second detected time is within a predetermined time period of the first detected time;
accessing file description metadata for the first computing device and the second computing device;
analyzing the file description metadata to identify anomalous files at the first computing device and the second computing device; and
determining that a ransomware attack has begun based on the determination that the first anomalous file backup activity and the second anomalous file backup activity are correlated, and based on the identified anomalous files at the first computing device and the second computing device.
8 . The system of claim 7 , wherein the operations further comprise:
accessing file backup metadata for a third computing device;
analyzing the file backup metadata for the third computing device to detect third anomalous file backup activity at the third computing device;
determining that the third anomalous file backup activity is correlated with the first anomalous file backup activity and the second anomalous file backup activity;
accessing file description metadata for the third computing device;
analyzing the file description metadata for the third computing device to identify anomalous files at the third computing device; and
wherein the determination that a ransomware attack has begun is further based on the determination that the third anomalous file backup activity is correlated with the first anomalous file backup activity and the second anomalous file backup activity, and further based on the identified anomalous files at the third computing device.
9 . The system of claim 7 , wherein the file description metadata comprises file extensions, wherein analyzing the file description metadata to identify anomalous files at the first computing device and the second computing device comprises determining file extensions of the anomalous files at the first computing device are different than file extensions of other files at the first computing device and that file extensions of the anomalous files at the second computing device are different than file extensions of other files at the second computing device.
10 . The system of claim 7 , wherein the file description metadata comprises at least one of a filename, a file MIME type, a file size, a file hash, and a time of file creation, reading, updating, or deletion.
11 . The system of claim 7 , wherein the first anomalous file backup activity comprises a change in file backup activity of a file backup operation at the first computing device compared to a plurality of other file backup operations at the first computing device.
12 . One or more non-transitory computer readable media encoding instructions which, when executed by one or more hardware processors, cause the one or more processors to perform operations comprising:
accessing file backup metadata for a first computing device and a second computing device;
analyzing the file backup metadata to detect first anomalous file backup activity at the first computing device and second anomalous file backup activity at the second computing device, wherein the first anomalous file backup activity has an associated first detected time and the second anomalous file backup activity has an associated second detected time;
determining that the first anomalous file backup activity and the second anomalous file backup activity are correlated based on the first anomalous file backup activity and the second anomalous file backup activity, wherein determining that the first anomalous file backup activity is correlated with the second anomalous file backup activity comprises determining that the second detected time is within a predetermined time period of the first detected time;
accessing file description metadata for the first computing device and the second computing device;
analyzing the file description metadata to identify anomalous files at the first computing device and the second computing device; and
determining that a ransomware attack has begun based on the determination that the first anomalous file backup activity and the second anomalous file backup activity are correlated, and based on the identified anomalous files at the first computing device and the second computing device.
13 . The one or more non-transitory computer readable media of claim 12 , wherein the operations further comprise:
accessing file backup metadata for a third computing device;
analyzing the file backup metadata for the third computing device to detect third anomalous file backup activity at the third computing device;
determining that the third anomalous file backup activity is correlated with the first anomalous file backup activity and the second anomalous file backup activity;
accessing file description metadata for the third computing device;
analyzing the file description metadata for the third computing device to identify anomalous files at the third computing device; and
wherein the determination that a ransomware attack has begun is further based on the determination that the third anomalous file backup activity is correlated with the first anomalous file backup activity and the second anomalous file backup activity, and further based on the identified anomalous files at the third computing device.
14 . The one or more non-transitory computer readable media of claim 12 , wherein the file description metadata comprises file extensions, wherein analyzing the file description metadata to identify anomalous files at the first computing device and the second computing device comprises determining file extensions of the anomalous files at the first computing device are different than file extensions of the other files at the first computing device and that file extensions of the anomalous files at the second computing device are different than file extensions of the other files at the second computing device.
15 . The one or more non-transitory computer readable media of claim 12 , wherein the file description metadata comprises at least one of a filename, a file MIME type, a file size, a file hash, and a time of file creation, reading, updating, or deletion.
16 . The one or more non-transitory computer readable media of claim 12 , wherein analyzing the file description metadata comprises identifying a first file on the first computing device as being anomalous based on the first file having the same filename and at least one of a different file extension and a different MIME type as a second file on the second computing device, wherein the second file has been identified as anomalous.
17 . The one or more non-transitory computer readable media of claim 12 , wherein the first anomalous file backup activity comprises a change in file backup activity of a file backup operation at the first computing device compared to a plurality of other file backup operations at the first computing device.