Ransomware detection and prevention
Embodiments are described for detecting ransomware attacks. Aspects include receiving a memory access request for a memory location. Aspects also include allowing the memory access request based on a determination that the memory location is not present in a decoy address table. Aspects further include terminating a process that made the memory access request based on a determination that the memory location is present in the decoy address table.
1. A computer-implemented method for detecting ransomware, the method comprising:
receiving a memory access request for a memory location;
based on a determination that the memory location is not present in a decoy address table, allowing the memory access request; and
based on a determination that the memory location is present in the decoy address table, terminating a process that made the memory access request,
wherein the decoy address table is created by:
identifying one or more high priority files in a memory, wherein the one or more high priority files includes one or more of sensitive user data and system backups;
reserving a plurality of decoy areas in the memory, wherein at least one of the plurality of decoy areas is associated with each of the one or more high priority files; and
storing the addresses of the plurality of decoy areas in the decoy address table.
2. The computer-implemented method of claim 1 , further comprising creating an alert of a detected malicious event based on the determination that the memory location is present in the decoy address table.
3. The computer-implemented method of claim 1 , wherein an appearance of the one or more high priority files to other programs is unchanged by reserving the plurality of decoy areas in the memory.
4. The computer-implemented method of claim 3 , wherein the at least one of the plurality of decoy areas associated with each of the one or more high priority files is appended to one of a beginning and an ending of a memory block containing the one or more high priority files.
5. The computer-implemented method of claim 1 , wherein the memory access request is an encryption request.
6. The computer-implemented method of claim 1 , wherein the decoy address table includes addresses of a plurality of decoy areas in the memory and wherein the plurality of decoy areas are randomly allocated small memory areas in the memory.
7. A system, comprising:
a memory; and
a processor; wherein the processor is configured to:
receive a memory access request for a memory location;
based on a determination that the memory location is not present in a decoy address table, allow the memory access request; and
based on a determination that the memory location is present in the decoy address table, terminate a process that made the memory access request,
wherein the decoy address table is created by:
identifying one or more high priority files in a memory, wherein the one or more high priority files includes one or more of sensitive user data and system backups;
reserving a plurality of decoy areas in the memory, wherein at least one of the plurality of decoy areas is associated with each of the one or more high priority files; and
storing the addresses of the plurality of decoy areas in the decoy address table.
8. The system of claim 7 , wherein the processor is further configured to create an alert of a detected malicious event based on the determination that the memory location is present in the decoy address table.
9. The system of claim 7 , wherein an appearance of the one or more high priority files to other programs is unchanged by reserving the plurality of decoy areas in the memory.
10. The system of claim 7 , wherein the at least one of the plurality of decoy areas associated with each of the one or more high priority files is appended to one of a beginning and an ending of a memory block containing the one or more high priority files.
11. The system of claim 7 , wherein the memory access request is an encryption request.
12. The system of claim 7 , wherein the decoy address table includes addresses of a plurality of decoy areas in the memory and wherein the plurality of decoy areas are randomly allocated small memory areas in the memory.
13. A computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions being executable by a processor to cause the processor to perform a method comprising:
receiving a memory access request for a memory location;
based on a determination that the memory location is not present in a decoy address table, allowing the memory access request; and
based on a determination that the memory location is present in the decoy address table, terminating a process that made the memory access request,
wherein the decoy address table is created by:
identifying one or more high priority files in a memory, wherein the one or more high priority files includes one or more of sensitive user data and system backups;
reserving a plurality of decoy areas in the memory, wherein at least one of the plurality of decoy areas is associated with each of the one or more high priority files; and
storing the addresses of the plurality of decoy areas in the decoy address table.
14. The computer program product of claim 13 , wherein the method further comprises creating an alert of a detected malicious event based on the determination that the memory location is present in the decoy address table.
15. The computer program product of claim 13 , wherein an appearance of the one or more high priority files to other programs is unchanged by reserving the plurality of decoy areas in the memory.
16. The computer program product of claim 13 , wherein the at least one of the plurality of decoy areas associated with each of the one or more high priority files is appended to one of a beginning and an ending of a memory block containing the one or more high priority files.
17. The computer program product of claim 16 , wherein the memory access request is an encryption request.