Acronis International Gmbh

Aliaksei Dodz

Stanislav Protasov

Serg Bell

Vladimir Strogov

Sergey Ulasen

Nikolay Grebennikov

Alexey Kostyushko

Denis Kopyrin

Oleg Ishanov

Systems and methods for protecting computing systems against ransomware attacks using AI-generated virtual file honeypots. Generative AI comprising a large language model generates virtual file honeypots automatically in response to attack vectors associated with suspect actors and ransomware families.

AI-generated virtual file honeypots for computing systems behavior-based protection against ransomware attacks

Systems and methods for firmware protection of industrial control systems. A kernel-level agent operating at a kernel mode intercepts a request to the resource, collects data associated with the intercepted request, and sends the collected data to a security service. A security service receives the collected data, analyzes the collected data to determine a verdict, and sends the verdict to the kernel-level agent. The kernel-level agent then executes a security action for the resource based on the verdict.

Firmware protection for industrial control systems

Systems and methods for embedding into a storage stack of a UNIX based computing device. A method includes building a file storage map for a file stored in computing device data storage, intercepting a system call associated with the file, intercepting a storage stack operation, and analyzing the system call and the storage stack operation using the file storage map to determine a change to a data block of the file. The method further includes building a shadow copy of the file on backup storage. The method further includes detecting a malicious operation based on the change to the data block.

Shadow backup and anti-malware protection for UNIX-based machines

Systems and methods for ransomware protection in advanced injection-based attacks. Events from a driver are analyzed to identify a potentially malicious actor. A confidence level is calculated for the potentially malicious actor identification to weigh the probability that the actor is malware or a source of malware. Behavior associated with the potentially malicious actor can be collected, if it is likely that the potentially malicious actor is associated with malware, such as if the confidence level is over a predetermined threshold. Subsequently, one or more virtual honeypots are generated for the suspicious processes and the response to the virtual honeypots is included in anti-ransomware heuristic analysis.

Virtual file honey pots for computing systems behavior-based protection against ransomware attacks

Systems and methods for ransomware protection in advanced injection-based attacks. The call stack(s) of injected threads are analyzed and a preliminary verdict of benign or malicious can be determined. Additional sensors collect data to associate injected threads with other activities or actors to further estimate the injected thread being benign or malicious. If the threat level is high enough, such as over a given threshold, the preliminary verdict can be determined to be malicious. Subsequently, one or more virtual honeypots are generated for the suspicious threads and the injected thread's response to the virtual honeypots included in anti-ransomware heuristic analysis.

Ransomware protection in advanced injection-based attacks

System and method for detecting and curing a hollowing attack is disclosed herein. The method comprises monitoring real-time process memory parameters of a target process; retrieving real-time process memory parameters of the target process; comparing the real-time process memory parameters of the target process with reference process parameters of the target process stored in a system storage of the computing system and parameters of the process creation call-back notification; detecting a hollowing attack based on the comparison in previous step; in response to detecting the hollowing attack, determining a threat source file of malicious code; determining address space of the hollowed process on the computing system based on system log data; and curing the computing system by blocking execution of the threat source file and deleting threat resources associated therewith from the computing system.

Systems and methods for preventing hollowing attack

Systems and methods for threat detection and analysis. A method includes monitoring at least one thread associated with at least one user process on a computing device. The method further includes detecting specific-system calls associated with at least one user process at user level. The specific-system calls are analyzed by applying a filter to system calls sequence feature sets associated with the specific-system calls for detecting one or more events of interest. A capture of a full stack trace of at least one user process is requested if the system calls sequence feature set is filtered and at least one event of interest is detected. A first level monitoring is provided to the computing device, which includes processing and analyzing the captured full stack trace by a machine learning (ML) stack trace analyzer to generate a first verdict for threat detection and analysis.

System and method for threat detection based on stack trace and user-mode sensors

Described herein are systems and methods for controlling access to a protected resource based on various criteria. In one exemplary aspect, a method comprises designating a plurality of program data installed on a computing system as protected program data; intercepting, by a kernel mode driver, a request from an untrusted application executing on the computing system to alter at least one of the protected program data; classifying, by a self-defense service, the untrusted application as a malicious application based on the intercepted request and information related to the untrusted application; and responsive to classifying the untrusted application as a malicious application, denying, by the kernel mode driver, access to the at least one of the protected program data.

Growing community of inventors

Singapore, Singapore

Aliaksei Dodz