Abschwächung der Ransomware-Aktivität eines Betriebssystems durch Überwachung vom Benutzerraum

Details

Veröffentlichungs-Nr.

EP4636624

Aktenzeichen

EP24216265

Anmeldetag

28. November 2024

Veröffentlichung

22. Oktober 2025

Rechtsraum

EP

IPC

G06F21/55G06F21/56

Abstract

Ransomware activity in operating systems can be mitigated by monitoring from user space. For example, a computing environment can generate an affinity score indicating a likelihood of ransomware activity associated with an operating system based on a first set of system calls detected from a user space of the operating system within a first time window. The computing environment can buffer one or more write operations from the first set of system calls during a second time window based on the affinity score. The computing environment can update the affinity score based on a second set of system calls detected from the user space of the operating system within the second time window. The computing environment can block execution of the one or more write operations based on the updated affinity score exceeding a predefined threshold.

Anmelder

Firmen

Red Hat, LLC
Red Hat, Inc.

Land

🇺🇸 USA

Fachgebiete