Sign in Subscribe
Ransomware

Palo Alto Networks Develops Innovative Ransomware Detection System

Strategic Insights

— 2 min read

Palo Alto Networks Inc. has been granted a patent for an innovative ransomware detection system that uses server message block (SMB) traffic to identify and prevent ransomware attacks. The system, developed by Jiang, Mengying et al., uses a trained model or a set of rules to identify the attempted creation of a ransom note on a server. This breakthrough technology aims to protect networks from unauthorized access and malicious activities, revolutionizing the field of cybersecurity.

Key Takeaways:

  • The patented system detects and prevents ransomware attacks by analyzing SMB traffic, a common protocol used in network communications.
  • The system uses a trained model or a set of rules to identify the attempted creation of a ransom note on a server, enabling early detection and mitigation of ransomware attacks.
  • The invention can be implemented as a process, an apparatus, a system, a composition of matter, a computer program product, or a processor configured to execute instructions stored on and/or provided by a memory coupled to the processor.
  • The system can detect a file encryption of a file on the server and initiated by the client, including detecting a file entropy change, partial encryption, and model trained on ransomware notes.
  • The applying includes using a set of heuristics, forwarding at least a portion of the network communication to a remote device, generating an alert, and terminating the session between the client and the server.
  • The method comprises receiving SMB traffic, determining the attempted creation of a ransom note, and performing a remedial action, including terminating the session between the client and the server.
  • The computer program product embodied in a non-transitory computer readable medium includes computer instructions for receiving SMB traffic, determining the attempted creation of a ransom note, and performing a remedial action.

Statistics:

  • The patented system is a significant improvement in cybersecurity, enabling the detection and prevention of ransomware attacks to protect networks from unauthorized access and malicious activities.
  • The system uses machine learning and artificial intelligence to analyze SMB traffic and identify potential ransomware threats, reducing the risk of data breaches and cyber attacks.
  • The patented system can be integrated into existing firewall appliances and network devices, making it a scalable and cost-effective solution for enterprise and small businesses.

Sources:

  • Jiang, Mengying. Inline ransomware detection via server message block (SMB) traffic. U.S. Patent Number 12445484, filed March 30, 2023, and published online on October 14, 2025. Patent URL (for desktop use only): https://ppubs.uspto.gov/pubwebapp/external.html?q=(12445484)&db=USPAT&type=ids
  • NewsRx LLC. Copyright 2025, NewsRx LLC.

Read more