Abstract: There is disclosed in one example a computing apparatus, including: a hardware platform including a processor and a memory; a system profile store; and a ransomware detection engine including instructions encoded within the memory to instruct the processor to: detect an operation, by a process, that results in an operation on a file, wherein the operation includes newly creating the file including a file type identifier, or where the file is an existing file, changing a file type identifier for the file; querying the system profile store with a combination of the file type identifier and metadata about the file; based at least in part on the querying, determining that the process is a suspected ransomware attack; and taking a remedial action.

Abstract: Provided are a method and a system for detecting mtDNA mutations. Specifically, provided is a method for detecting mtDNA mutations in trace cells, comprising: (a) extracting mtDNA in trace cells, the number of trace cells being 1 to 4; (b) performing PCR amplification on different predetermined regions of the mtDNA to acquire amplification products of the different predetermined regions, the different predetermined regions of the mtDNA being superimposed to form the full-length mtDNA; (c) mixing the amplification products of the different predetermined regions to obtain an mtDNA full-length nucleic acid sequencing library; (d) sequencing the nucleic acid sequencing library to obtain sequencing results; and (e) on the basis of the sequencing results, determining mtDNA mutations in the trace cells to be tested.

Abstract: There is disclosed in one example a computing apparatus, including: a hardware platform including a processor and a memory; a system profile store; and a ransomware detection engine including instructions encoded within the memory to instruct the processor to: detect an operation, by a process, that results in an operation on a file, wherein the operation includes newly creating the file including a file type identifier, or where the file is an existing file, changing a file type identifier for the file; querying the system profile store with a combination of the file type identifier and metadata about the file; based at least in part on the querying, determining that the process is a suspected ransomware attack; and taking a remedial action.