Google's Latest AI Ransomware Defense Only Goes So Far

"Ransomware attacks have loomed for years as an urgent digital threat with no easy solution -especially as they have evolved to include data grab-and-leak attacks that may not even involve data-encrypting malware at all. Traditional ransomware that locks up files and systems is still rampant, though, and Google on Tuesday launched a new defense for its Google Drive for desktop apps that aims to quickly detect ransomware activity and halt cloud syncing before an infection can spread."

"While antivirus scanners monitor for signs of malware across a system, the new ransomware protections in Drive for desktop are meant to act as an additional line of defense. The detection capability is built on an AI model that Google trained using millions of real victims files that had been encrypted with various strains of ransomware. And the feature is designed to detect and contain suspected ransomware in desktop Drive very quickly."

""The innovative part is doing that real time detection and quickly stopping the sync to minimize the damage. That was what our customers were telling us they really wanted," says Jason James, a product manager for Google Workspace. "You've got hundreds, millions, billions of users-and so to check every file quickly and accurately and wherever the user is around the world were all challenges.""

Google added ransomware protections to Drive for desktop that detect suspicious file changes and stop cloud syncing to prevent spread. The detection uses an AI model trained on millions of real victim files encrypted by different ransomware strains. The feature operates quickly to detect and contain suspected ransomware activity on desktop Drive. The protection complements existing malware monitoring in Drive, Chrome, and Gmail and was developed with Google's antivirus engineering team. For enterprise Google Workspace customers, the system protects files of any format in Drive for desktop and enables easy restoration of encrypted or corrupted data. The feature mitigates damage but does not eliminate ransomware risk entirely.

Read at WIRED