Patent attributes
According to an aspect of the present disclosure, a digital processing system, in response to identifying multiple files opened with write permission by a process, creates a corresponding backup copy of each of the opened files. The system computes a frequency of opening of the files with write permission by the process, and then determines whether the computed frequency is greater than a threshold. If the frequency is determined to be greater than the threshold, the system provides control to a user to recover any of the files (opened by the process) based on the corresponding backup copy (previously created in response to opening). Thus, the execution of a ransomware in the system may be potentially detected and the associated maladies (such as unavailability of personal data, requirement to make payment for recovering the personal data, etc.) may be avoided.
