SYSTEMS AND METHODS FOR RANSOMWARE DETECTION

1 . A method for detecting ransomware comprising:

monitoring a file system of an endpoint device;

detecting a plurality of file events from the file system;

generating a plurality of statistical snapshots, the plurality of statistical snapshots comprising two or more statistical snapshots for each of the files from each of the plurality of file events;

analyzing the plurality of statistical snapshots to detect one or more file encryptions or one or more file deletions within the plurality of file events; and

analyzing the one or more file encryptions or the one or more file deletions to detect ransomware.

2 . The method of claim 1 further comprising, in response to detecting ransomware, performing a remediation action on the endpoint device.

3 . The method of claim 2 , wherein the remediation action comprises at least one of:

notifying an entity associated with the endpoint device;

terminating at least one process related to the one or more file encryptions or the one or more file deletions;

suspending at least one injected thread related to the one or more file encryptions or the one or more file deletions;

quarantining at least one executable file related to the one or more file encryptions or the one or more file deletions; or

cleaning up residue associated with the one or more file encryptions or the one or more file deletions.

4 . The method of claim 3 , wherein the residue comprises an autorun entry.

5 . The method of claim 3 , wherein quarantining the at least one executable file comprises preventing the files from running again using a pre-execution blocklist of hashes.

6 . The method of claim 1 , wherein the monitoring of the file system is performed using a file-system kernel driver.

7 . The method of claim 1 , wherein detecting the plurality of file events comprises detecting events associated with at least one of document files, images, videos, spreadsheets, presentations, password files, source code, databases, keys, or wallets.

8 . The method of claim 1 , wherein the plurality of file events comprises at least one of an open event, a read event, a MEMMAP event, an overwrite event, a delete event, a truncate event, a create_new event, a rename event, or a close event.

9 . The method of claim 1 , wherein analyzing the plurality of statistical snapshots to detect one or more file encryptions or the one or more file deletions within the plurality of file events comprises;

computing one or more features for each of the two or more statistical snapshots;

comparing the one or more features to calculate an aggregated score for a file event; and

in response to calculating the aggregated score for the file event above an encryption threshold, determining that the file event is a file encryption;

wherein the one or more statistical features comprise at least one of a fuzzy distance, a Shannon entropy, an extension change, an extension/magic mismatch, a header modification, an aggregated printable strings ratio, a longest printable string, a Kullback-Leibler divergence, or a Chi-square test.

10 . The method of claim 1 comprising:

detecting an open event for a file;

determining to continue tracking events for the file based on one or more of an extension of the file and a location of the file;

detecting at least one additional event for the file; and

generating an after statistical snapshot for the file after detection of the at least one additional event.

11 . The method of claim 10 , wherein detecting the at least one additional event for the file comprises detecting the at least one additional event for the file within a pre-defined time window.

12 . The method of claim 11 , wherein the pre-defined time window is about three seconds.

13 . The method of claim 10 comprising tagging the file as modified if the at least one additional event for the file comprises one or more of a write event, an MEMMAP event, or an overwrite event.

14 . The method of claim 13 comprising, in response to tagging the file as modified:

re-reading data of the file;

generating the after statistical snapshot for the file; and

comparing the after statistical snapshot to any previously generated snapshot for the file.

15 . The method of claim 10 comprising tagging the file as deleted if the at least one additional event for the file is equivalent to a delete event or a truncate to zero event.

16 . The method of claim 15 comprising, in response to tagging the file as deleted:

identifying a pre-created substitute file;

generating the after statistical snapshot for the pre-created substitute file; and

comparing the after statistical snapshot to any previously generated snapshot for the deleted file.

17 . The method of claim 10 comprising tagging the file as a substitute if the at least one additional event for the file comprises a create_new event.

18 . The method of claim 17 comprising, in response to tagging the file as a substitute:

identifying an associated pre-deleted file;

generating the after statistical snapshot from the substitute file; and

comparing the after statistical snapshot to any previously generated snapshot for the pre-deleted file.

19 . The method of claim 1 , wherein analyzing the one or more file encryptions to detect ransomware comprises:

identifying an entity associated with at least one of the one or more file encryptions or the one or more file deletions;

incrementing an encryption count associated with the entity;

determining a number of file types encrypted by the entity;

determining that the encryption count is above a ransomware threshold within a predefined time period;

determining that the number is above a file type threshold; and

in response to determining that the number is above the file type threshold, determining that the entity is exhibiting ransomware-like behavior.

20 . The method of claim 19 , wherein the predefined time period is about one minute.

21 . The method of claim 19 , wherein the entity comprises at least one of a process, a group of processes, or at least one injected thread within a process.

22 . The method of claim 19 , wherein determining that the entity is exhibiting ransomware-like behavior is further based on at least one of a rarity of changed files, a total volume of space occupied by the changed files, or entropy changes across the changed file.

23 . The method of claim 1 , wherein analyzing the one or more file encryptions to detect ransomware comprises:

identifying an entity associated with at least one of the one or more file encryptions or the one or more file deletions;

determining that the entity accessed or attempted to access a list of languages on the endpoint device; and

in response to determining that the entity accessed or attempted to access the list of languages on the endpoint device, determining that the entity is exhibiting ransomware-like behavior.

24 . The method of claim 1 , wherein analyzing the one or more file encryptions to detect ransomware comprises:

identifying an entity associated with at least one of the one or more file encryptions or the one or more file deletions;

determining that a threshold number of files have been erased from the endpoint device; and

in response to determining that the threshold number of files have been erased from the endpoint device, determining that the entity is exhibiting ransomware-like behavior.

25 . The method of claim 1 , wherein analyzing the one or more file encryptions or the one or more file deletions to detect ransomware comprises applying a machine learning algorithm trained on a set of ransomware samples to identify ransomware-like behavior.

26 . The method of claim 1 , wherein monitoring the file system of the endpoint device comprises determining a likelihood that a file will be a target of a ransomware attack.

27 . The method of claim 26 , wherein determining the likelihood is based on a prevalence of the file or a hash value of the file.