Abstract: Techniques of operating a computer involve providing controls to an OS that monitor a rate at which commands in an operating system are performed. Along these lines, ransomware performs the OS commands it needs to control access to data files on a computer by performing those commands rapidly. In many cases, such rapid sequences of commands, e.g., read-copy-encrypt-delete, are performed much more rapidly than would be done by a typical user. Accordingly, the OS is then provided the capacity to monitor, e.g., a number of specified command sequences (e.g., read-copy-encrypt-delete) within some specified period of time (e.g., a minute, 5 minutes, an hour, or greater or less). If the number is greater than some threshold number, then the computer may take a remedial action such as issuing an alert to the user and/or limiting the rate at which the commands may be performed.

Abstract: Techniques of protecting computers from malware involve migrating processes running applications from a first sandbox to a second sandbox. Along these lines, when a computer being protected from malware receives application code over a network, the computer generates a set of processes that runs the application code on a first machine acting as a sandbox. After the set of processes produce a first output on the first machine, the computer migrates the set of processes to a second machine acting as another sandbox. After the set of processes produces a second output on the second machine, the computer grants or denies access to the application code based the second output. Because migration can occur over the entire lifecycle of an application and migration is difficult to detect, migrating processes running malware makes it more difficult for the malware to evade detection.