Ransomware infection detection in filesystems
Described herein is a system that detects ransomware infection in filesystems. The system detects ransomware infection by using backup data of machines. The system detects ransomware infection in two stages. In the first stage, the system analyzes a filesystem's behavior. The filesystem's behavior can be obtained by loading the backup data and crawling the filesystem to create a filesystem metadata including information about file operations during a time interval. The filesystem determines a pattern of the file operations and compares the pattern to a normal patter to analyze the filesystem's behavior. If the filesystem's behavior is abnormal, the system proceeds to the second stage to analyze the content of the files to look for signs of encryption in the filesystem. The system combines the analysis of both stages to determine whether the filesystem is infected by ransomware.
1 . A method, comprising:
accessing a data store to obtain a first set of snapshots corresponding to a machine, each snapshot indicating data of the machine at a corresponding point in time, the first set of snapshots comprising a plurality of snapshots spanning a period of time;
generating metadata indicating operations to one or more files in a filesystem of the machine over time intervals corresponding to the first set of snapshots;
training, using the metadata, a ransomware detection model operative to define a normal pattern of behavior of the filesystem and to detect an infection of the filesystem of the machine by ransomware, wherein the ransomware detection model comprises a first model feature that is based at least in part on the metadata corresponding to the first set of snapshots, and wherein the ransomware detection model further comprises a second model feature that is based at least in part on respective entropies of the one or more files in the filesystem of the machine;
receiving, by the ransomware detection model, a second snapshot of the machine, the second snapshot indicating data of the machine at a corresponding point in time subsequent to the first set of snapshots, wherein the second snapshot indicates operations to one or more files in the filesystem of the machine over a second time interval;
applying the ransomware detection model to the second snapshot to screen for abnormal behavior of the filesystem, wherein the ransomware detection model is operative to assess changes in the filesystem over the second time interval and entropies of one or more files in the filesystem associated with the second time interval, wherein the ransomware detection model is further operative to calculate one or more scores indicating a respective probability that a behavior of the filesystem is anomalous;
comparing the one or more scores to a respective threshold value;
based at least in part on at least one of the one or more scores crossing the respective threshold value, generating a user interface for presenting a determination that the filesystem is infected; and
providing the user interface for display.
2 . The method of claim 1 , wherein the machine is a virtual machine.
3 . The method of claim 1 , wherein the changes in the filesystem are recorded in the metadata, the metadata including a list of entries corresponding to data changes in the filesystem.
4 . The method of claim 1 , wherein the period of time comprises a plurality of time intervals corresponding to the first set of snapshots and wherein the period of time is greater than the second time interval.
5 . The method of claim 1 , wherein the ransomware detection model is operative to generate a combined anomaly score by combining the one or more scores.
6 . The method of claim 1 , further comprising:
training the ransomware detection model using additional training data, the additional training data including at least one of filesystem data of filesystems owned by multiple users, and filesystem data of multiple filesystems owned by a user.
7 . The method of claim 1 , wherein the training of the ransomware detection model is performed in a cloud platform.
8 . The method of claim 1 , wherein the ransomware detection model is hosted in a cloud platform.
9 . The method of claim 1 , wherein the ransomware detection model comprises a first machine learning model and a second machine learning model, wherein the first machine learning model includes the first model feature and is operative to determine whether the behavior of the filesystem is anomalous, wherein the second machine learning model includes the second model feature and is operative to detect a ransomware encryption event.
10 . The method of claim 9 , wherein the ransomware detection model applies the second machine learning model to the second snapshot when the first machine learning model identifies that the filesystem behavior of the machine is anomalous.
11 . An apparatus for data management, comprising:
at least one processor;
memory coupled with the at least one processor; and
instructions stored in the memory and executable by the at least one processor to cause the apparatus to perform operations comprising:
accessing a data store to obtain a first set of snapshots corresponding to a machine, each snapshot indicating data of the machine at a corresponding point in time, the first set of snapshots comprising a plurality of snapshots spanning a period of time;
generating metadata indicating operations to one or more files in a filesystem of the machine over time intervals corresponding to the first set of snapshots;
training, using the metadata, a ransomware detection model operative to define a normal pattern of behavior of the filesystem and to detect an infection of the filesystem of the machine by ransomware, wherein the ransomware detection model comprises a first model feature that is based at least in part on the metadata corresponding to the first set of snapshots, and wherein the ransomware detection model further comprises a second model feature that is based at least in part on respective entropies of the one or more files in the filesystem of the machine;
receiving, by the ransomware detection model, a second snapshot of the machine, the second snapshot indicating data of the machine at a corresponding point in time subsequent to the first set of snapshots, wherein the second snapshot indicates operations to one or more files in the filesystem of the machine over a second time interval;
applying the ransomware detection model to the second snapshot to screen for abnormal behavior of the filesystem, wherein the ransomware detection model is operative to assess changes in the filesystem over the second time interval and entropies of one or more files in the filesystem associated with the second time interval, wherein the ransomware detection model is further operative to calculate one or more scores indicating a respective probability that a behavior of the filesystem is anomalous;
comparing the one or more scores to a respective threshold value;
based at least in part on at least one of the one or more scores crossing the respective threshold value, generating a user interface for presenting a determination that the filesystem is infected; and
providing the user interface for display.
12 . The apparatus of claim 11 , wherein the machine is a virtual machine.
13 . The apparatus of claim 11 , wherein the changes in the filesystem are recorded in the metadata, the metadata including a list of entries corresponding to data changes in the filesystem.
14 . The apparatus of claim 11 , wherein the period of time comprises a plurality of time intervals corresponding to the first set of snapshots and wherein the period of time is greater than the second time interval.
15 . The apparatus of claim 11 , wherein the ransomware detection model is operative to generate a combined anomaly score by combining the one or more scores.
16 . The apparatus of claim 11 , the operations further comprising:
training the ransomware detection model using additional training data, the additional training data including at least one of filesystem data of filesystems owned by multiple users, and filesystem data of multiple filesystems owned by a user.
17 . The apparatus of claim 11 , wherein the training of the ransomware detection model is performed in a cloud platform.
18 . The apparatus of claim 11 , wherein the ransomware detection model is hosted in a cloud platform.
19 . The apparatus of claim 11 , wherein the ransomware detection model comprises a first machine learning model and a second machine learning model, wherein the first machine learning model includes the first model feature and is operative to determine whether the behavior of the filesystem is anomalous, wherein the second machine learning model includes the second model feature and is operative to detect a ransomware encryption event.
20 . The apparatus of claim 19 , wherein the ransomware detection model applies the second machine learning model to the second snapshot when the first machine learning model identifies that the filesystem behavior of the machine is anomalous.