Acronis International Gmbh

Valeriy Chernyakovsky

Serguei M Beloussov

Stanislav Protasov

Vladimir Strogov

Sergey Ulasen

Alexey Kostyushko

Alexey Dod

A system and method is provided for detecting a suspicious process in an operating system environment. In an exemplary aspect, a method comprises generating, by a hardware processor, a file honeypot in a directory in a file system and receiving a directory enumeration request from a process executing in the operating system environment. The method comprises determining whether the process is identified in a list of trusted processes and in response to determining that the process is not in the list of trusted processes, providing, to the process by the file system, a file list including the file honeypot responsive to the directory enumeration request. The method further comprises intercepting, by a file system filter driver, a file modification request for the file honeypot from the process, and identifying the process as a suspicious object responsive to intercepting the file modification request from the process.

Systems and methods for detecting a suspicious process in an operating system environment using a file honeypots

A system and method is provided for detecting ransomware and malicious programs. An exemplary method comprises generating, by a hardware processor, a file honeypot in a directory in a filesystem, wherein the file honeypot is included on a file list of contents of the directory, receiving a directory enumeration request from a process executing in an operating system environment, determining whether the process is identified in a list of trusted processes based on one or more of a certificate, fingerprint, name, and process identifier, when the process is not found in the list of trusted processes, providing, by the filesystem, the file list including the file honeypot to the process responsive to receiving the directory enumeration request and otherwise, providing the file list excluding the file honeypot to the process, intercepting, by a filesystem filter driver, a file modification request for the file honeypot from the process when the file honeypot is included in the file list and identifying the process as a suspicious object responsive to intercepting the file modification request from the process.

Systems and methods for preventive ransomware detection using file honeypots

Growing community of inventors

Moscow, Russia

Valeriy Chernyakovsky