Artificial intelligence will save from ransomware
Acronis True Image is a reliable solution for protecting user data. In Acronis True Image 2017 and Acronis True Image 2017 New Generation, we set a very high bar in all that concerns reliability, simplicity and usability. These products were implemented backing up and restoring data profiles of the social network Facebook, proactive protection against ransomware Acronis Active Protection, blockchain-based Acronis Notary data notarization function and digital signature of electronic documents using Acronis ASign. In addition, in the version for macOS, we added NAS support and the ability to wirelessly back up mobile devices.
Every year the number of threats continues to grow, they become more complicated and more dangerous. According to Kaspersky Lab data, in the second quarter of 2017, 15,663 new modifications of ransomware programs were detected (for comparison, in the same period of 2016, the new malware was almost 70% less - 9226) and 268284 attacks were recorded.
Figure 1. The number of new modifications of ransomware according to Kaspersky Lab data
The two biggest attacks occurred this year. First, in May, the WannaCry ransomware program attacked telephone companies, hospitals, factories and hundreds of other organizations in more than 100 countries, and then, in June, the NotPetya cryptographer made thousands of users worldwide regret the lack of backup copies of their data.
')
Figure 2. The number of ransomware attacks according to Kaspersky Lab
Today, the world's largest media outlets speak about these cyber attacks, so users are beginning to better represent the scale of the threat. According to our global research on data protection, almost 50% of respondents know about extortionists, against 35% in the past. The study was conducted in August of this year; users from the USA, Great Britain, Australia, Japan, Germany, France and Of Spain.
However, for the time being, low user awareness and the constant complication of the code of extortion programs leaves no doubt that the number of attacks will increase, and therefore data protection solutions must also be improved.
Therefore, one of the main innovations of Acronis True Image 2018 has become Acronis Active Protection 2.0 technology, which is designed to “repel attacks”. Acronis Active Protection technology introduced at the beginning of the year is based on behavioral heuristics that help identify suspicious activity and prevent ransomware attacks. This approach to protection worked perfectly and works for most of the existing malware, however, their modern versions are so advanced that they can “deceive” the system. Imagine a malware that is embedded in MS Word, and by encrypting all the documents in its entirety, leaves the headers intact. In this case, behavioral heuristics do not attribute this process to a dangerous one, and the malware manages to “partially encrypt” almost all files before you have time to do something.
In order to resist such attacks, the ML (machine learning) Engine was implemented in Acronis Active Protection 2.0, which analyzes the work of both infected and non-infected programs, forms characteristic patterns based on their comparison and, in the event of their subsequent detection, stops suspicious processes .
In St. Petersburg and Moscow, we have already deployed more than 20 physical farms, as well as the Microsoft Azure virtual cloud, which automatically downloads and analyzes processes in various operating systems and programs in a pure form and when infected with extortion programs. The algorithm “learns”, what is the difference between these processes and what indicators can signal an infection.
Our internal tests showed that even if the attack was not fixed based on behavioral heuristics, ML Engine Acronis Active Protection 2.0 noticed it and blocked it. In addition to this, machine learning has helped us find and formulate new rules for the heuristic component. By the existing rules, the “robot” found another 100. The most attentive and picky could already ask themselves: how much hard disk space and memory does such an algorithm require? The answer will surprise you a little: the system takes less than 14 MB! If we talk about loading the memory, then there is nothing to worry about: the ML Engine runs in the background and turns on only once every 30 seconds, without taking up much memory.
Acronis Active Protection 2.0 also got a dashboard, which shows a graph of all processes in the system, including suspicious ones. Suspicious processes are considered to be without a digital signature (or with an invalid signature), or if there is a suspicion that the code was injected into the process using an Injection DLL. If such processes begin to change user files, then these files are stored in the cache. If too many files are modified, our heuristics work, the system suspends the process and informs the user that this is most likely an ransomware program and offers to add these processes to the blacklist or allow them to continue. Also on this dashboard displays information about upcoming updates, statistics on the number of blocked Active Protection processes, the number of files recovered after the attack, and news from the Acronis blog.
Among other features that we have updated, you can mention the wizard for creating bootable media. Now when creating a bootable flash drive or a CD / DVD, we use the Windows Recovery Partition. If earlier for this you had to download a special kit from Microsoft, depending on the size of the build from 4 to 6 GB, then in Acronis True Image 2018 we decided to make everything a bit more elegant without downloading too much. On modern Windows systems, there are Recovery sections from which we can take this ADK itself (a set of tools for deploying and evaluating Windows) and based on it we make bootable media without loading special whales.
We also have the opportunity to convert backups to virtual disks in the format of VHD (x). This virtual disk can be used in different ways: for example, as a data carrier (enter, rebuild folders and files, some of them can be restored by simple copying, without resorting to the help of True Image). You can boot as a Hyper-V virtual machine (starting with Windows 7, it is available in PRO versions), or you can boot natively as with WRP.
Another innovation will be useful for our users - the cloning system of active Windows disks. Disk cloning will help, for example, when moving from HDD to SSD or if there is a suspicion that the disk may soon become unusable. Now, to copy the system disk, you do not need to reboot - you can “on the fly” connect a new device to USB and clone to it.
One of the main innovations in the UI was the data analysis interface in the backup - this is a way to visualize the backup process, show the user what is happening in the process and what data we save.
Acronis True Image 2018 shows statistics for each backup: right below the blocks, which shows what and where we backed up, a chart is displayed showing proportionally how many photos in the archive, how many video and audio files, documents, how many system files (these are files that are in Windows or macOS system folders). Plus, the activity tab shows the entire history of operations with backups like statuses or errors. All this made the process of working with backups more visual and pleasing to the eye.
We have added a few more useful features to the product. First, it is an opportunity to postpone a backup until the laptop is connected to the network. As you know, backup is a fairly energy-intensive process (many disk accesses and copy operations, especially if backup is rarely performed and a lot of data is copied and transferred at a time), and if it starts when the battery is just a little bit, it can play a cruel joke. To prevent this from happening, it is possible to prevent the application from starting any backup while the device is not connected to the power grid. The second feature was the automatic backup of mobile devices over a Wi-Fi network on the NAS. If the phone is on the same network as the NAS and their backup is configured, then the phone immediately starts backing up on its own without user intervention - you don’t even need to connect to the computer.
In Acronis True Image 2018, we have expanded support for social network backup. To Facebook, which became supported with Acronis True Image 2017, we added support for Instagram. In September, users around the world will be able to back up all their photos, videos, information / statistics from the profile. Unfortunately, due to the technical limitations of Instagram itself, the user cannot restore all the data, as it is implemented in Facebook, that is, backing up more than 150 comments under one post, but you can restore both individual and all profile photos with one click.
What can be said in the end: the development of Acronis True Image 2018 has become a real challenge for us. We seriously expanded its functionality and added popular chips, both in the program part and in the UI part. We have reason to believe that True Image 2018 will set a new standard for smart backup systems for home users, protecting the data of the whole family and small business.
Every year the number of threats continues to grow, they become more complicated and more dangerous. According to Kaspersky Lab data, in the second quarter of 2017, 15,663 new modifications of ransomware programs were detected (for comparison, in the same period of 2016, the new malware was almost 70% less - 9226) and 268284 attacks were recorded.
Figure 1. The number of new modifications of ransomware according to Kaspersky Lab data
The two biggest attacks occurred this year. First, in May, the WannaCry ransomware program attacked telephone companies, hospitals, factories and hundreds of other organizations in more than 100 countries, and then, in June, the NotPetya cryptographer made thousands of users worldwide regret the lack of backup copies of their data.
')
Figure 2. The number of ransomware attacks according to Kaspersky Lab
Today, the world's largest media outlets speak about these cyber attacks, so users are beginning to better represent the scale of the threat. According to our global research on data protection, almost 50% of respondents know about extortionists, against 35% in the past. The study was conducted in August of this year; users from the USA, Great Britain, Australia, Japan, Germany, France and Of Spain.
However, for the time being, low user awareness and the constant complication of the code of extortion programs leaves no doubt that the number of attacks will increase, and therefore data protection solutions must also be improved.
Therefore, one of the main innovations of Acronis True Image 2018 has become Acronis Active Protection 2.0 technology, which is designed to “repel attacks”. Acronis Active Protection technology introduced at the beginning of the year is based on behavioral heuristics that help identify suspicious activity and prevent ransomware attacks. This approach to protection worked perfectly and works for most of the existing malware, however, their modern versions are so advanced that they can “deceive” the system. Imagine a malware that is embedded in MS Word, and by encrypting all the documents in its entirety, leaves the headers intact. In this case, behavioral heuristics do not attribute this process to a dangerous one, and the malware manages to “partially encrypt” almost all files before you have time to do something.
In order to resist such attacks, the ML (machine learning) Engine was implemented in Acronis Active Protection 2.0, which analyzes the work of both infected and non-infected programs, forms characteristic patterns based on their comparison and, in the event of their subsequent detection, stops suspicious processes .
In St. Petersburg and Moscow, we have already deployed more than 20 physical farms, as well as the Microsoft Azure virtual cloud, which automatically downloads and analyzes processes in various operating systems and programs in a pure form and when infected with extortion programs. The algorithm “learns”, what is the difference between these processes and what indicators can signal an infection.
Our internal tests showed that even if the attack was not fixed based on behavioral heuristics, ML Engine Acronis Active Protection 2.0 noticed it and blocked it. In addition to this, machine learning has helped us find and formulate new rules for the heuristic component. By the existing rules, the “robot” found another 100. The most attentive and picky could already ask themselves: how much hard disk space and memory does such an algorithm require? The answer will surprise you a little: the system takes less than 14 MB! If we talk about loading the memory, then there is nothing to worry about: the ML Engine runs in the background and turns on only once every 30 seconds, without taking up much memory.
Acronis Active Protection 2.0 also got a dashboard, which shows a graph of all processes in the system, including suspicious ones. Suspicious processes are considered to be without a digital signature (or with an invalid signature), or if there is a suspicion that the code was injected into the process using an Injection DLL. If such processes begin to change user files, then these files are stored in the cache. If too many files are modified, our heuristics work, the system suspends the process and informs the user that this is most likely an ransomware program and offers to add these processes to the blacklist or allow them to continue. Also on this dashboard displays information about upcoming updates, statistics on the number of blocked Active Protection processes, the number of files recovered after the attack, and news from the Acronis blog.
Among other features that we have updated, you can mention the wizard for creating bootable media. Now when creating a bootable flash drive or a CD / DVD, we use the Windows Recovery Partition. If earlier for this you had to download a special kit from Microsoft, depending on the size of the build from 4 to 6 GB, then in Acronis True Image 2018 we decided to make everything a bit more elegant without downloading too much. On modern Windows systems, there are Recovery sections from which we can take this ADK itself (a set of tools for deploying and evaluating Windows) and based on it we make bootable media without loading special whales.
We also have the opportunity to convert backups to virtual disks in the format of VHD (x). This virtual disk can be used in different ways: for example, as a data carrier (enter, rebuild folders and files, some of them can be restored by simple copying, without resorting to the help of True Image). You can boot as a Hyper-V virtual machine (starting with Windows 7, it is available in PRO versions), or you can boot natively as with WRP.
Another innovation will be useful for our users - the cloning system of active Windows disks. Disk cloning will help, for example, when moving from HDD to SSD or if there is a suspicion that the disk may soon become unusable. Now, to copy the system disk, you do not need to reboot - you can “on the fly” connect a new device to USB and clone to it.
One of the main innovations in the UI was the data analysis interface in the backup - this is a way to visualize the backup process, show the user what is happening in the process and what data we save.
Acronis True Image 2018 shows statistics for each backup: right below the blocks, which shows what and where we backed up, a chart is displayed showing proportionally how many photos in the archive, how many video and audio files, documents, how many system files (these are files that are in Windows or macOS system folders). Plus, the activity tab shows the entire history of operations with backups like statuses or errors. All this made the process of working with backups more visual and pleasing to the eye.
We have added a few more useful features to the product. First, it is an opportunity to postpone a backup until the laptop is connected to the network. As you know, backup is a fairly energy-intensive process (many disk accesses and copy operations, especially if backup is rarely performed and a lot of data is copied and transferred at a time), and if it starts when the battery is just a little bit, it can play a cruel joke. To prevent this from happening, it is possible to prevent the application from starting any backup while the device is not connected to the power grid. The second feature was the automatic backup of mobile devices over a Wi-Fi network on the NAS. If the phone is on the same network as the NAS and their backup is configured, then the phone immediately starts backing up on its own without user intervention - you don’t even need to connect to the computer.
In Acronis True Image 2018, we have expanded support for social network backup. To Facebook, which became supported with Acronis True Image 2017, we added support for Instagram. In September, users around the world will be able to back up all their photos, videos, information / statistics from the profile. Unfortunately, due to the technical limitations of Instagram itself, the user cannot restore all the data, as it is implemented in Facebook, that is, backing up more than 150 comments under one post, but you can restore both individual and all profile photos with one click.
What can be said in the end: the development of Acronis True Image 2018 has become a real challenge for us. We seriously expanded its functionality and added popular chips, both in the program part and in the UI part. We have reason to believe that True Image 2018 will set a new standard for smart backup systems for home users, protecting the data of the whole family and small business.
Source: https://habr.com/ru/post/337092/
All Articles