US Patent 10262138 Techniques for ransomware detection and mitigation

An attacker who gains control of a computer system using malicious software (malware) may be able to do anything to the data on the system. One type of malware, sometimes referred to as ransomware, can encrypt the contents of a hard drive or other data repository, preventing those contents from being accessed by their rightful owners. A ransomware attack can be greatly disruptive to an individual or business, and result in loss of data and loss of computer system uptime, impacting overall computing productivity. By detecting that ransomware is operating on a computer (e.g. by correlating between the original data and content in different cache layers), the negative effects of the ransomware may be mitigated or avoided.