Slash Boxes

SoylentNews is people

posted by Fnord666 on Sunday May 17 2020, @02:06AM   Printer-friendly
from the novel-approach dept.

Software developed by SMU stops ransomware attacks:

Engineers from SMU's Darwin Deason Institute for Cybersecurity have developed software that detects ransomware attacks before attackers can inflict catastrophic damage.

[...] Unlike existing methods, such as antivirus software or other intrusion detection systems, SMU's new software works even if the ransomware is new and has not been used before.

SMU's detection method is known as sensor-based ransomware detection because the software doesn't rely on information from past ransomware infections to spot new ones on a computer. In contrast, existing technology needs signatures of past infections to do its job.

"With this software we are capable of detecting what's called zero-day ransomware because it's never been seen by the computer before," said Mitch Thornton, executive director of the Deason Institute and professor of electrical and computer engineering in SMU's Lyle School of Engineering. "Right now, there's little protection for zero-day ransomware, but this new software spots zero-day ransomware more than 95 percent of the time."

[...] "The results of testing this technique indicate that rogue encryption processes can be detected within a very small fraction of the time required to completely lock down all of a user's sensitive data files," Taylor noted. "So the technique detects instances of ransomware very quickly and well before extensive damage occurs to the victim's computer files."

[...] SMU's software functions by searching for small, yet distinguishable changes in certain sensors that are found inside computers to detect when unauthorized encryptions are taking place.

[...] Use of the computer's own devices to spot ransomware "is completely different than anything else that's out there," Taylor said.

Original Submission

This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 0) by Anonymous Coward on Sunday May 17 2020, @02:51AM (1 child)

    by Anonymous Coward on Sunday May 17 2020, @02:51AM (#995227)

    What BS, none of this is new. Firstly behaviour analysis of the "something is touching and fudging a bunch of your files" is not new. Secondly, Avast and AVG will alert you if an executable is not common and/or known to them. They don't work on a black-list only approach, they also check the SIG against their white-list and warn you if its not there.

    Backups. Backups and suitable group policy. If I really don't trust a user I have been known to disallow execution of any file in /Users/ and demote them to standard rather than administrator for their own good.

  • (Score: 3, Informative) by Immerman on Sunday May 17 2020, @04:26AM

    by Immerman (3985) on Sunday May 17 2020, @04:26AM (#995246)

    *Incremental* backups, with history. Simple backups will happily overwrite all your valid files with their newly updated encrypted versions, so provide almost no protection against ransomware.