Ransomware detection has steadily moved up the stack — from matching file signatures, to watching individual processes, to, increasingly, reasoning about how the whole device is behaving. The logic of the climb is simple: each lower layer can be evaded by an attacker who controls the details, but the higher-level behavior of a device under a ransomware attack is harder to disguise, because it's a consequence of the attack actually doing its work.
The grant US12259976B1, "Detecting ransomware attacks in a device based on device behavior" (issued March 25, 2025, assigned to HackerStrike Corporation), works at the device level. Its CPC classifications combine the malware classes G06F 21/566 and G06F 21/577, the sandboxing class G06F 21/53, and the neural-network class G06N 3/08 — device-behavior modeling backed by machine learning.
“Disclosed are techniques to detect and prevent malware attacks, and more specifically, a subset of malware attacks called ransomware (which is not to suggest that the disclosed techniques are not applicable to detecting other types of malware attacks that exhibit some of the same behaviors).”— U.S. Patent No. 12,259,976 source
The mechanism worth understanding is the holistic view. A ransomware attack in progress changes how the whole device behaves: CPU and disk activity spike in characteristic ways, processes spawn and interact in recognizable patterns, system resources get consumed by the work of bulk encryption. Modeling the device's overall behavior — rather than scrutinizing one file or one process — lets the system recognize the attack from its full footprint, which is harder for an attacker to mask than any single component.
For defenders, the practical takeaway is that the highest-level behavioral signals are often the most robust. An attacker can obfuscate a binary, rename files, and tweak individual process behavior, but they cannot easily hide the device-wide consequences of encrypting everything on disk — that's the attack itself, and it has to happen. Watching at the device level targets the part that can't be faked away.
The trade-off, familiar by now, is sensitivity versus false positives: legitimate heavy workloads can resemble an attack at the device level, and the model has to tell them apart. The patent reflects the continuing maturation of ransomware defense — each generation moves to a higher, harder-to-evade vantage point, and device behavior is the current frontier of that climb.