Ronald M Gallella

US Patent:

20180018458, Jan 18, 2018

Filed:

Jul 14, 2016

Appl. No.:

15/210165

Inventors:

- Santa Clara CA, US
Cedric Cochin - Portland OR, US
Andrew Furtak - Beaverton OR, US
Adam James Carrivick - Ashland, GB
Yury Bulygin - Beaverton OR, US
John J. Loucaides - Forest Grove OR, US
Christiaan Beek - West-Linn OR, US
Carl D. Woodward - Santa Clara CA, US
Ronald Gallella - Beaverton OR, US
Gregory Michael Heitzmann - Beaverton OR, US
Joel R. Spurlock - Portland OR, US

Assignee:

McAfee, Inc. - Santa Clara CA

International Classification:

G06F 21/56
G06F 21/62

Abstract:

Particular embodiments described herein provide for an electronic device that can be configured to allow for the mitigation of ransomware. For example, the system can determine that an application begins to execute, determine that the application attempts to modify a file, determine a file type for the file, and create a security event if the application is not authorized to modify the file type. In another example, the system determines an entropy value between the file and the attempted modification of the file, and create a security event if the entropy value satisfies a threshold or determine a system entropy value that includes a rate at which other files on the system are being modified by the application, and create a security event if the system entropy value satisfies a threshold.