Behavior-based ransomware detection
An anti-malware application detects, stops, and quarantines ransomware. The anti-malware application monitors threads executing on a computing device and detects behaviors that conform to a predefined set of behaviors indicative of ransomware. Responsive to detecting these behaviors, indicators are stored to a log in a storage device. Each of the indicators in the log is associated with respective scores. A running score for each thread is generated by combining the respective scores of the indicators in the log. Responsive to determining that the running score exceeds a predefined threshold score, execution of the thread is terminated. The source ransomware file is then identified and quarantined.
1. A method for detecting and removing malware, the method comprising:
monitoring a target thread executing on a computing device;
storing to a log in a storage device, a parent reference to a parent thread that launched the target thread or injected code into the target thread;
detecting, by a processor, a behavior of the target thread that conforms to one of a predefined set of behaviors indicative of ransomware;
responsive to detecting the behavior, storing a new indicator associated with the detected behavior to the log, the log storing a plurality of past indicators for respective previously detected behaviors of the target thread, and the log storing respective scores for the new indicator and the plurality of past indicators;
generating a running score for the target thread by combining the respective scores of the plurality of past indicators and the new indicator associated with the target thread in the log;
determining that the running score for the target thread exceeds a predefined threshold score;
responsive to determining that the running score exceeds the predefined threshold score, terminating execution of the target thread;
identifying the parent thread based on the parent reference in the log and terminating execution of the parent thread;
identifying based on a source file reference stored in the log in association with the parent thread, a source malware file that launched the parent thread; and
responsive to identifying the source malware file that launched the parent thread, quarantining the source malware file.
2. The method of claim 1 , wherein generating the running score comprises:
identifying, based on a child reference stored in the log, a child thread created by the target thread;
identifying a child score for the child thread; and
combining the child score with the respective scores of the plurality of past indicators and the new indicator associated with the target thread.
3. The method of claim 1 , wherein generating the running score comprises:
identifying, based on a process reference stored in the log, a process in which the target thread is executing;
determining a process score for the process based on process-level indicators associated with the process stored in the log; and
combining the process score with the respective scores of the plurality of past indicators and the new indicator associated with the target thread.
4. The method of claim 1 , wherein detecting the behavior of the thread comprises:
detecting that a target file which is not created by and is not deleted by the target thread is read by the target thread and written to by the target thread;
detecting that the thread transforms the target file from an unencrypted file to an encrypted file;
detecting that the target thread transforms content of the target file such that it fails to conform an expected format associated with a file extension of the target file.
5. The method of claim 1 , wherein detecting the behavior of the target thread comprises:
detecting that the target thread reads an unencrypted file;
detecting that the target thread deletes the unencrypted file; and
detecting that the target thread creates a new encrypted file.
6. The method of claim 1 , wherein detecting the behavior of the thread comprises:
detecting that the target thread reads a target file;
detecting that the target thread deletes the target file; and
detecting that the target thread creates a new file in a same folder as the target file.
7. The method of claim 1 , further comprising:
detecting that a time period since detection of the new indicator exceeds a time threshold; and
removing the new indicator from the log responsive to the time period since the detection of the new indicator exceeding the time threshold.
8. A non-transitory computer-readable storage medium storing instructions for detecting and removing malware, the instructions when executed by a processor cause the processor to perform steps including:
monitoring a target thread executing on a computing device;
storing to a log in a storage device, a parent reference to a parent thread that launched the target thread or injected code into the target thread;
detecting a behavior of the target thread that conforms to one of a predefined set of behaviors indicative of ransomware;
responsive to detecting the behavior, storing a new indicator associated with the detected behavior to the log, the log storing a plurality of past indicators for respective previously detected behaviors of the target thread, and the log storing respective scores for the new indicator and the plurality of past indicators;
generating a running score for the target thread by combining the respective scores of the plurality of past indicators and the new indicator associated with the target thread in the log;
determining that the running score for the target thread exceeds a predefined threshold score;
responsive to determining that the running score exceeds the predefined threshold score, terminating execution of the target thread;
identifying the parent thread based on the parent reference in the log and terminating execution of the parent thread;
identifying based on a source file reference stored in the log in association with the parent thread, a source malware file that launched the parent thread; and
responsive to identifying the source malware file that launched the parent thread, quarantining the source malware file.
9. The non-transitory computer-readable storage medium of claim 8 , wherein generating the running score comprises:
identifying, based on a child reference stored in the log, a child thread created by the target thread;
identifying a child score for the child thread; and
combining the child score with the respective scores of the plurality of past indicators and the new indicator associated with the target thread.
10. The non-transitory computer-readable storage medium of claim 8 , wherein generating the running score comprises:
identifying, based on a process reference stored in the log, a process in which the target thread is executing;
determining a process score for the process based on process-level indicators associated with the process stored in the log; and
combining the process score with the respective scores of the plurality of past indicators and the new indicator associated with the target thread.
11. The non-transitory computer-readable storage medium of claim 8 , wherein detecting the behavior of the thread comprises:
detecting that a target file which is not created by and is not deleted by the target thread is read by the target thread and written to by the target thread;
detecting that the thread transforms the target file from an unencrypted file to an encrypted file;
detecting that the target thread transforms content of the target file such that it fails to conform an expected format associated with a file extension of the target file.
12. The non-transitory computer-readable storage medium of claim 8 , wherein detecting the behavior of the thread comprises:
detecting that the target thread reads an unencrypted file;
detecting that the target thread deletes the unencrypted file; and
detecting that the target thread creates a new encrypted file.
13. The non-transitory computer-readable storage medium of claim 8 , wherein detecting the behavior of the thread comprises:
detecting that the target thread reads a target file;
detecting that the target thread deletes the target file; and
detecting that the target thread creates a new file in a same folder as the target file.
14. The non-transitory computer-readable storage medium of claim 8 , further comprising:
detecting that a time period since detection of the new indicator exceeds a time threshold; and
removing the new indicator from the log responsive to the time period since the detection of the new indicator exceeding the time threshold.
15. A computing system comprising:
a processor; and
a non-transitory computer-readable storage medium storing instructions for detecting and removing malware, the instructions when executed by the processor cause the processor to perform steps including:
monitoring a target thread executing on a computing device;
storing to a log in a storage device, a parent reference to a parent thread that launched the target thread or injected code into the target thread;
detecting a behavior of the target thread that conforms to one of a predefined set of behaviors indicative of ransomware;
responsive to detecting the behavior, storing a new indicator associated with the detected behavior to the log, the log storing a plurality of past indicators for respective previously detected behaviors of the target thread, and the log storing respective scores for the new indicator and the plurality of past indicators;
generating a running score for the target thread by combining the respective scores of the plurality of past indicators and the new indicator associated with the target thread in the log;
determining that the running score for the target thread exceeds a predefined threshold score;
responsive to determining that the running score exceeds the predefined threshold score, terminating execution of the target thread;
identifying the parent thread based on the parent reference in the log and terminating execution of the parent thread;
identifying based on a source file reference stored in the log in association with the parent thread, a source malware file that launched the parent thread; and
responsive to identifying the source malware file that launched the parent thread, quarantining the source malware file.
16. The computing system of claim 15 , wherein detecting the behavior of the thread comprises:
detecting that a target file which is not created by and is not deleted by the target thread is read by the target thread and written to by the target thread;
detecting that the thread transforms the target file from an unencrypted file to an encrypted file;
detecting that the target thread transforms content of the target file such that it fails to conform an expected format associated with a file extension of the target file.
17. The computing system of claim 15 , wherein detecting the behavior of the thread comprises:
detecting that the target thread reads an unencrypted file;
detecting that the target thread deletes the unencrypted file; and
detecting that the target thread creates a new encrypted file.
18. The computing system of claim 15 , further comprising:
detecting that a time period since detection of the new indicator exceeds a time threshold; and
removing the new indicator from the log responsive to the time period since the detection of the new indicator exceeding the time threshold.