Detecting ransomware

1. A computer-implemented anti-ransomware method, comprising:

selecting a file for inspection;

assigning the file to a type class according to a file type identifier;

receiving an expected byte correlation for the type class;

computing, according to a byte distribution of the file, a byte correlation for the file;

comparing, via statistical analysis, the byte correlation to the expected byte correlation; and

determining that the file has been compromised, comprising determining that the file has a byte correlation that deviates from the expected byte correlation by more than a threshold; and

taking a ransomware remediation action for the file.

2. The method of claim 1 , wherein the neural network is a featureless neural network.

3. The method of claim 1 , wherein the statistical analysis is selected from the group consisting of entropy, Monte Carlo pi, Monte Carlo pi error, serial correlation coefficient, arithmetic mean, and chi square distribution.

4. The method of claim 3 , wherein determining that the file under inspection has been compromised comprises identifying a statistically-significant mismatch in two or more statistical analyses from the group.

5. The method of claim 1 , wherein the ransomware remediation action comprising creating a backup of the file and restoring the file from the backup.

6. The method of claim 5 , wherein the backup is a transitory backup.

7. The method of claim 1 , further comprising identifying a malicious process according to file artefacts.

8. The method of claim 1 , further comprising identifying and remediating a process that instigated selecting a file for investigation.

9. An electronic computing apparatus, comprising means for:

selecting a file for inspection;

assigning the file to a type class according to a file type identifier;

receiving an expected byte correlation for the type class;

computing, according to a byte distribution of the file, a byte correlation for the file;

comparing, via statistical analysis, the byte correlation to the expected byte correlation; and

determining that the file has been compromised, comprising determining that the file has a byte correlation that deviates from the expected byte correlation by more than a threshold; and

taking a ransomware remediation action for the file.

10. The apparatus of claim 9 , wherein the means comprise one or more tangible, non-transitory computer-readable storage mediums having stored thereon executable instructions to instruct a processor to provide a heuristic layer.

11. The apparatus of claim 9 , wherein the means comprise a convolutional neural network (CNN).

12. The apparatus of claim 11 , wherein the CNN comprises a field-programmable gate array (FPGA).

13. The apparatus of claim 11 , wherein the CNN comprises a bank of GPUs.

14. The apparatus of claim 11 , wherein the CNN comprises an ASIC.

15. A ransomware mitigation engine, comprising:

a hardware platform comprising a processor and a memory; and

instructions encoded within the memory to instruct the processor to:

provision a convolutional neural network (CNN);

identify a file write to a newly-created file;

compute, within the CNN, a byte correlation factor for the file;

operate a file type identification (FTI) layer of the CNN to identify a file type of the file;

screen the file to determine whether the file is correct for the file type;

upon determining that the file is not correct for the file type, use a statistical analysis the file to compute a delta between an expected value and an observed value;

based at least in part on the delta, designate the file as having been compromised by a ransomware attack; and

take a remedial action for the ransomware attack.

16. The ransomware mitigation engine of claim 15 , wherein the statistical analysis is selected from the group consisting of entropy, Monte Carlo pi, Monte Carlo pi error, serial correlation coefficient, arithmetic mean, and chi square distribution.

17. The ransomware mitigation engine of claim 16 , wherein determining that the file has been compromised comprises identifying a statistically-significant mismatch in two or more statistical analyses from the group.

18. The ransomware mitigation engine of claim 15 , wherein the CNN is a featureless CNN.

19. One or more tangible, non-transitory computer-readable storage mediums having stored thereon executable instructions to program or configure a logic device to provide a ransomware mitigation engine, the ransomware mitigation engine to:

select a file for analysis;

identify a write-to-disk operation for the file, wherein the write-to-disk operation is a file write or a new file creation;

access a neural network;

within the neural network, determine within a screening confidence that the file belongs to a file type and includes a byte pattern that is correct for the file type;

determine that the screening confidence is below a threshold;

analyze the file to determine a statistical difference between an expected value and a computed value; and

from the difference, determine that the file is a candidate file for having been compromised by a ransomware attack and requires further analysis and/or remedial action.

20. The one or more tangible, non-transitory computer-readable mediums of claim 19 , wherein determining that the file has been compromised comprises identifying a statistically-significant mismatch in two or more statistical analyses from the group.