Google Drive adds AI to detect ransomware before it spreads

"Google Drive for desktop is adding ransomware detection using an AI model trained on "millions of real-world ransomware samples" that will "look for signals that a file has been maliciously modified." When Google's AI believes it has detected ransomware activity on a Windows or macOS system, like trying to encrypt or corrupt files en masse, it will automatically stop syncing Drive files, alert users on their desktop and over email, and allow users to restore their files to an older version."

""We've built a specialized AI model, trained on millions of real-world ransomware samples, to look for signals that a file has been maliciously modified," Google says in a blog post. "The detection engine adapts to novel ransomware by continuously analyzing file changes and incorporating new threat intelligence from VirusTotal. When Drive detects unusual activity that suggests a ransomware attack, it automatically pauses syncing of affected files, helping to prevent widespread data corruption across an organization's Drive and the disruption of work.""

"Ransomware attacks are still on the rise, with the Office of the Director of National Intelligence reporting that there were 5,289 ransomware attacks worldwide in 2024, a 15 percent increase from 2023."

Google Drive for desktop will include ransomware detection powered by a specialized AI model trained on millions of real-world ransomware samples. The model looks for signals that files have been maliciously modified and adapts to novel ransomware by analyzing file changes and using threat intelligence from VirusTotal. When ransomware-like activity is detected on Windows or macOS, Drive will pause syncing of affected files, notify users on desktop and by email, and provide options to restore files to older versions. The feature begins rolling out in open beta immediately with a target general availability by the end of the year.

Read at The Verge