Detecting ransomware
There is disclosed in one example a ransomware mitigation engine, including: a processor; a convolutional neural network configured to provide file type identification (FTI) services including: identifying an access operation of a file as a write to the file or newly creating the file; computing a byte correlation factor for the file; classifying the file as belonging to a file type; determining with a screening confidence that the file type is correct for the file; determining that the screening confidence is below a screening confidence threshold; and circuitry and logic to provide heuristic analysis including: receiving notification that the confidence is below the confidence threshold; performing a statistical analysis of the file to determine a difference between an expected value and a computed value; determining from the difference, with a detection confidence, that the file has been compromised; and identifying the file as having been compromised by a ransomware attack.
1 . An apparatus, comprising:
a memory that stores an instruction; and
a processor configured to execute the instruction to
determine a file type of a file,
identify an access operation on the file,
perform a statistical analysis of the file to determine a difference between an expected byte distribution value of the file type and a computed byte distribution value of the file, and
performing a remediation at least in part based on the access operation.
2 . The apparatus of claim 1 , wherein the statistical analysis is performed at least in part based on a determination that a screening confidence that the file type is correct for the file is below a screening confidence threshold.
3 . The apparatus of claim 1 , wherein the access operation is a write to the file, and the remediation includes reverting the file.
4 . The apparatus of claim 1 , wherein the statistical analysis is at least in part based on a plurality of bytes from the start or the end of the file.
5 . The apparatus of claim 1 , wherein the processor is further configured to extract a file header or extension associated with the type of the file.
6 . The apparatus of claim 1 , wherein the access operation is a deletion of the file, and the remediation includes restoring the file from a backup file of the file.
7 . The apparatus of claim 1 , wherein the access operation is a creation of the file, and the remediation includes killing a process that created the file.
8 . A non-transitory, computer-readable medium having stored thereon instructions that, when executed, cause a processor to perform operations comprising:
determining a file type of a file;
identifying an access operation on the file;
performing a statistical analysis of the file to determine a difference between an expected byte distribution value of the file type and a computed byte distribution value of the file; and
performing a remediation at least in part based on the access operation.
9 . The medium of claim 8 , wherein the statistical analysis is performed at least in part based on a determination that a screening confidence that the file type is correct for the file is below a screening confidence threshold.
10 . The medium of claim 8 , wherein the access operation is a write to the file, and the remediation includes reverting the file.
11 . The medium of claim 8 , wherein the statistical analysis is at least in part based on a plurality of bytes from the start or the end of the file.
12 . The medium of claim 8 , the operations further comprising:
extracting a file header or extension associated with the type of the file.
13 . The medium of claim 8 , wherein the access operation is a deletion of the file, and the remediation includes restoring the file from a backup file of the file.
14 . The medium of claim 8 , wherein the access operation is a creation of the file, and the remediation includes killing a process that created the file.
15 . A method, comprising:
determining a file type of a file;
identifying an access operation on the file;
performing a statistical analysis of the file to determine a difference between an expected byte distribution value of the file type and a computed byte distribution value of the file; and
performing a remediation at least in part based on the access operation.
16 . The method of claim 15 , wherein the access operation is a write to the file, and the remediation includes reverting the file.
17 . The method of claim 15 , wherein the statistical analysis is at least in part based on a plurality of bytes from the start or the end of the file.
18 . The method of claim 15 , wherein the processor is further configured to extract a file header or extension associated with the type of the file.
19 . The method of claim 15 , wherein the access operation is a deletion of the file, and the remediation includes restoring the file from a backup file of the file.
20 . The method of claim 15 , wherein the access operation is a creation of the file, and the remediation includes killing a process that created the file.