Check Point Software Technologies Ltd.

Haggai David

Liran Orevi

Ilan Moshkovich

Pavel Kavalenka

Mikita Karniushka

A device and method are provided for protecting against malware attacks affecting a computer system. To do so, system operations are detected and categorized as benign, suspicious, or malicious. Suspicious actions are delayed and placed in a queue instead of being immediately executed. The process initiating the suspicious action is determined and the suspicious action is categorized as benign or malicious based on the initiating process. When the suspicious action is categorized as a benign action, the suspicious action is performed. Conversely, when the suspicious action is categorized as a malicious action, the suspicious process is terminated, and the malicious action is removed from the unperformed actions queue without performing the malicious action.

System and method for protecting against wipers by delaying suspicious actions

A system, method, and device are provided for detecting and mitigating a storage attack at the block level by generating canary blocks by marking blocks of data (referred to as memory blocks) such that other programs do not modify these canary blocks that are monitored to detect data storage attacks that attempt to modify the canary blocks and/or by monitoring statistical and behavioral features of activities over blocks, whether they can be modified by other programs or not. The system and method also backup the memory blocks by backing up memory blocks as they are modified. When a data storage attack is detected, the attack is stopped, and the files are remediated using the backup of the affected memory blocks.

Growing community of inventors

Petah-Tikva, Israel

Haggai David