Google Drive will now detect ransomware with help from AI

Unfortunately, ransomware has become more and more prevalent in recent years. According to cybersecurity firm Mandiant, ransomware accounted for 21 percent of the intrusion incidents last year. The fact that it's been a growing issue means that it's been working out for hackers and other bad actors. They've been making millions off of ransomware.

But, Google's newest feature is hoping to deal with the ransomware problem by helping users stop its spread and detect it before the problem gets worse. The search giant has announced that it has begun rolling out an AI-powered feature for Google Drive for desktop that detects ransomware, stops the affected files from syncing, and allows the user to easily restore any altered files.

Google Drive for desktop is available for both Windows and Mac and the tool is available for both versions of the app. A commercial Google Workspace subscription is required for the ransomware detection tool. 

Credit: Google

Ransomware works by locking computer files, usually through encryption, from the infected user. The bad actors then extort money out of the victim in exchange for unlocking the files.

In a post, Google explains how ransomware has mostly been dealt as an antivirus issue. While it's obviously important to stop ransomware before the initial infection takes place, Google came up with a solution for when that first layer of protection has been breached.

According to Google, the company has trained AI on millions of ransomware attack samples to notice identifiers that a file is being altered maliciously. The new AI-powered tool is able to then detect a ransomware's attempt to encrypt or corrupt files and intervenes by pausing the files from syncing. As Google describes it, the tool puts a "protective bubble around a user's files." 

The ransomware detection tool in Google Drive for desktop works automatically. Once ransomware is detected, the tool will also automatically pause the syncing of affected files. Users will then receive a desktop and email notification informing them of the ransomware and guide them through the steps to take to restore their affected files.

The role of Google Drive for desktop's tool is to stop the spread of the affected files to other users and devices within an organization. The purpose of ransomware is for bad actors to extort users for monetary gain in exchange for access to their files. If the Google Drive for desktop tool enables users to restore the affected files to their previous state, then the bad actors have failed, even if the ransomware infects a device.