Microsoft Technology Licensing, LLC

Filip Chelarescu

John David Rodrigues

Steven James Bailey

Meir Elie Abergel

Parthipan Thayanithy

Benjamin N Truelove

Andrew Keith Glover

Jose Araujo Barreto

Adam Christopher Czeisler

Ronak M Shah

Justin D Harding

Yolando Pereira

Meir E Abergel

Andrew Glover

A cloud storage server accesses a plurality of server-stored files of a cloud storage account of a client device. The cloud storage server determines that one or more server-stored files from the plurality of server-stored files are affected by a malware activity. The cloud storage server generates a graphical user interface that includes a detection notification and a confirmation request, the detection notification indicating a detected presence of malware in the one or more server-stored files and metadata corresponding to the one or more server-stored files, the confirmation request indicating a request for the client device to confirm the detected presence of malware in the one or more server-stored files. A confirmation response is received from the client device. The confirmation response identifies at least one of the one or more server-stored files and confirming the presence of malware activity in the identified server-stored files.

User verification of malware impacted files

A system and method for providing automated service-based malware remediation. When a computing device is attacked by malware such as ransomware, multiple manual steps are usually needed to fully remediate the device. Users are typically required to follow several steps to remove the ransomware, and potentially must engage in the challenging task of reimaging the impacted device as well as choosing a restore point for point-in-time recovery. The disclosed systems provide a mechanism by which a cloud-based service manages a fully automated remediation and file recovery process for the user.

Automated malware remediation and file restoration management

Methods and systems for repairing user devices infected with malicious code. One method includes storing registration information for a plurality of user devices accessing a remote file storage system, the registration information including a unique identifier of each user device and an identifier of an antivirus software installed locally on each user device. The method also includes, in response to detecting an infected file within the remote file storage system, determining a unique identifier of one of the a user device included in the plurality of user devices interacting with the infected file, accessing the registration information to identify, based on the unique identifier of the user device interacting with the infected file within the remote file storage system, an identifier of antivirus software installed locally on the user device, and remotely initiating the antivirus software installed locally on the user device based on the identifier of the antivirus software.

File storage service initiation of antivirus software locally installed on a user device

A cloud storage server receives a detection notification from a client device. The cloud storage server is configured to store files received from the client device. The detection notification indicates a ransomware activity detected by the client device. The cloud storage server receives a remediation notification from the client device. The remediation notification indicates that the ransomware activity has been remediated by the client device. The cloud storage server updates an operation of a server-based ransomware detection application based on the detection notification and the remediation notification.

Coordinating service ransomware detection with client-side ransomware detection

A system and method for detection and management of atypical synchronization sessions of electronic content. The system is configured to determine whether a pending or ongoing synchronization session between a client device and cloud storage service is associated with a condition that will delay the synchronization process. The proposed system and method can significantly improve the ability of users to safeguard their documents as well as reduce the likelihood of data loss.

Long upload time detection and management

A cloud storage server accesses a plurality of server-stored files of a cloud storage account of a client device and determines that one or more compromised server-stored files from the plurality of server-stored files are affected by a malware activity. The cloud storage server determines a plurality of recovery options based on an identification of the one or more compromised server-stored files and the time at which changes to the one or more compromised server-stored files became affected by the malware activity. The plurality of recovery options comprises a suggested restore point identifying a restore time to which changes to the one or more compromised server-stored files are reverted. The cloud storage server transmits a recovery notification that indicates the plurality of recovery options to the client device.

Selection of restore point based on detection of malware attack

A cloud storage server receives a request from a client device to store a file. The cloud storage server stores the file in a storage device of the cloud storage server. The cloud storage server determines features of the server-stored file and detects ransomware activity based on the features of the server-stored file. The cloud storage server sends a notification of the ransomware activity to the client device. The client device confirms the presence or an absence of the ransomware activity in the server-stored file. The cloud storage server updates an operation of the detection of the ransomware activity based on the received ransomware confirmation.

Service identification of ransomware impacted files

A cloud storage server determines features of files in a storage account of the cloud storage server. The storage account is registered with a client device. The cloud storage server detects ransomware activity based on the features of the files. A notification is generated to the client device. The notification indicates the detected ransomware activity in the storage account, and one or more remediation options for the detected ransomware activity in the storage account. The cloud storage server receives, from the client device, a remediation option selected from the one or more remediation options and recovers one or more files in the storage account based on the selected remediation option.

Service identification of ransomware impact at account level

Identification of an entity performing a deletion or modification action on locally stored files and notification to mitigate risks to cloud stored files is provided. A local or remote file watcher may monitor locally stored files and detect a deletion or modification action. The file watcher may also identify an entity performing the deletion or modification action. The entity may be an application, a process, a user other than the user that is the owner of the files, or the user himself/herself. The file watcher may further determine one or more alert conditions or rules associated with the affected file(s) and/or the entity, that is under which circumstances an alert is to be issued. The alert notification(s) may be issued to the user, an administrator, a cloud storage service, and/or a data protection service such that protective measures can be taken if necessary.

Identification of entity performing operation on local file(s) and notification to reduce misuse risk

Cloud-based storage services are provided for storing and/or sharing content across multiple devices, where the content is periodically synchronized between the devices and the storage service. Embodiments are directed to detection of bulk operations associated with content stored at a storage service to protect users both proactively and remedially from accidental and/or nefarious content alterations propagating to the storage service and/or other devices. A model may be created based on a usage pattern associated with the content, an attempted operation performed on the content may be detected, and the attempted operation may be compared to the model to determine whether the operation deviates from the usage pattern. If the attempted operation deviates from the usage pattern, a preservation policy for the content at the storage service may be modified and a notification of the attempted operation may be provided to obtain user approval.

Detection of bulk operations associated with remotely stored content

Cloud-based storage services are provided for storing data across multiple devices, where access to the data is subject to a first authentication process. Embodiments are directed to a data protection feature to prevent accidental deletion or modification of the data stored at the cloud via unintended user actions on the clients or actions by nefarious software or hackers. For example, a data protection feature for a portion of data stored at the storage service may be selected, where the feature includes elevation of the first authentication process. An attempted operation performed on the portion of data may be detected. If the attempted operation is deletion or modification of the portion of data, a second authentication process may be prompted to enable the attempted operation to be performed on the portion of data at the storage service. The second authentication process may be elevated compared to the first authentication process.

Protection feature for data stored at storage service

Cloud-based storage services are provided for storing and/or sharing content across multiple devices, where the content is periodically synchronized between the devices and the storage service. Embodiments are directed to detection of bulk operations associated with content stored at a storage service to protect users both proactively and remedially from accidental and/or nefarious content alterations propagating to the storage service and/or other devices. A model based on a usage pattern monitored and provided by a client device may be received at the client device from the storage service. An attempted operation performed on the content may be detected, and the attempted operation may be compared to the model to determine whether the operation deviates from the usage pattern. If the attempted operation deviates from the usage pattern, execution of the attempted operation and synchronization of the content with the storage service may be prevented until the attempted operation is approved.

Growing community of inventors

Kirkland, WA, United States of America

Filip Chelarescu