公开(公告)号：US20200067975A1

公开(公告)日：2020-02-27

申请号：US16248641

申请日：2019-01-15

Applicant: Box, Inc.

Inventor： Alok Ojha ,  Advait D. Karande ,  Peter Loer ,  Jeremy Scott Spiegel

IPC: H04L29/06 ,  H04L29/08

Abstract: Systems and methods for ransomware protection in collaboration systems. One embodiment operates in conjunction with a collaboration system that manages one or more user devices that store device-local copies of content objects in storage areas of the one or more user devices. The collaboration system is accessed by the one or more user devices to facilitate collaboration activity over the content objects. Patterns of collaboration activity are classified, and in some cases, such patterns are deemed to be indicative of ransomware. If ransomware is indicated to be running on a user device, the collaboration system is notified that a ransomware process has been detected on the user device. The collaboration system delivers a prevention policy to other user devices that interface with the collaboration system. The prevention policy is in turn enforced by the other user devices to prevent synchronization of content object changes made by the ransomware.

公开(公告)号：US12099619B2

公开(公告)日：2024-09-24

申请号：US16248641

申请日：2019-01-15

Applicant: Box, Inc.

Inventor： Alok Ojha ,  Advait D. Karande ,  Peter Loer ,  Jeremy Scott Spiegel

IPC: G06F21/62 ,  G06F16/11 ,  G06F21/53 ,  G06F21/57 ,  G06N5/04 ,  G06N20/00 ,  H04L9/40 ,  H04L67/06 ,  H04L67/55

CPC classification number: G06F21/6218 ,  G06F16/11 ,  G06F21/53 ,  G06F21/577 ,  G06F21/6227 ,  G06N5/04 ,  G06N20/00 ,  H04L63/102 ,  H04L63/105 ,  H04L63/107 ,  H04L63/1416 ,  H04L63/1466 ,  H04L67/06 ,  H04L67/55 ,  G06F2221/034

Abstract: Systems and methods for ransomware protection in collaboration systems. One embodiment operates in conjunction with a collaboration system that manages one or more user devices that store device-local copies of content objects in storage areas of the one or more user devices. The collaboration system is accessed by the one or more user devices to facilitate collaboration activity over the content objects. Patterns of collaboration activity are classified, and in some cases, such patterns are deemed to be indicative of ransomware. If ransomware is indicated to be running on a user device, the collaboration system is notified that a ransomware process has been detected on the user device. The collaboration system delivers a prevention policy to other user devices that interface with the collaboration system. The prevention policy is in turn enforced by the other user devices to prevent synchronization of content object changes made by the ransomware.