Patent ID: 9292687
Filing Date: 2016-03-22
CPC Classification: G06F,H04L,H04W

Claim Text:
1. A method in a computer for detecting a file encryption attack attempting to encrypt file data, the method comprising: detecting, by a computing device, an attempt to overwrite existing file data of a file with new file data; calculating, by the computing device, a difference in entropy between the new file data and the existing file data, wherein the calculating the difference in entropy comprises calculating a measure of how well the existing file and the new file data could be compressed without data loss given a pre-determined compression scheme; using, by the computing device, said difference in entropy to identify a file encryption attack; performing, by the computing device, a response to the identified file encryption attack, wherein the response comprises at least one of: preventing the attempt to overwrite the existing file data; reverting the attempt to overwrite the existing file data; terminating a program, process, service or thread which performed the attempt to overwrite the existing file data; and notifying the user and sending a notification to a remote server of the identified attack.