Ransomware detection and prevention based on user-added values

摘要

A method for ransomware detection and prevention includes receiving a stream of events to which one or more computer system events are assigned; generating data of knowledge of user added values for one or more digital assets by modeling digital asset interactions based on the event stream, including accumulating user added values of each of the one or more digital assets; and detecting ransomware behavior based at least in part on knowledge of the user added values, including analyzing the destruction of the user added values for the one or more digital assets.