EN DE
Storage,  Security

Porting a ransomware detection engine

We assisted a Silicon Valley-based security products company in porting their ransomware detection and prevention engine from Windows to Linux. This project enabled the client to offer robust protection against ransomware attacks on Linux platforms and helped reuse the same codebase minimising maintenance overheads.

Client overview

  • Our client is a Silicon Valley company specializing in security products. They offer solutions to protect both unstructured data, such as files in a filesystem, and structured data, like databases. Their products are compatible with major Unix and Windows variants and operate within the kernel or user space based on the security assurances required by their clientele.

Problem

The client had a product that detects and prevents ransomware attacks on Windows by tracking the read and write patterns of processes. Once a process is marked as malicious, further I/Os from the process are blocked. This engine functions within the kernel space.

The client requested the Coriolis engineering team to:


Port the ransomware detection engine to Linux.


Integrate the engine with the client's filesystem driver.


Port test scripts from Windows to Linux.

Solution

Porting the ransomware detection engine to Linux

The Coriolis engineering team ported the detection engine to Linux, ensuring that the identical code could be utilized on both platforms. This approach allowed the client to maintain a single code base for both Linux and Windows, simplifying maintenance and updates.

Integrating the engine with the filesystem driver

The client aimed to add ransomware detection capabilities to their filesystem driver. The engineering team modified the filesystem driver to intercept all I/Os and pass them to the ransomware engine. This ensured comprehensive detection of any ransomware activity, as all types of I/Os were monitored.

Porting test scripts from Windows to Linux

The client's Windows team had a test suite that emulated common ransomware behaviors for conformance testing on new builds. The engineering team ported these tests to Linux, modifying Windows-specific tests to meet Linux standards. This ensured that the ransomware detection engine was rigorously tested on the Linux platform.

Results

Enhanced security for linux platforms

Successfully ported the ransomware detection engine to Linux, providing robust protection against ransomware attacks for Linux assets.

Seamless integration

Ensured seamless integration of the engine with the client's filesystem driver, enabling comprehensive monitoring and detection of malicious activities.

Reduced testing overhead

Ported and modified the test scripts from Windows to Linux, ensuring thorough testing and validation of the ransomware engine on the Linux platform.

Conclusion

  • The Coriolis engineering team delivered a successful port of the client's ransomware detection and prevention engine to Linux. This project enabled the client to extend their robust ransomware protection to Linux platforms, safeguarding their customers' Linux assets from ransomware attacks. By maintaining a unified code base for both Windows and Linux, the client can efficiently manage and update their ransomware detection capabilities across different operating systems.

Other case studies