After the recent spread of the WannaCry ransomware - which proved one more time that this kind of attack is capable of causing serius damage and dangerous disruptions to critical services - I asked myself why there is no easy protection against this kind of malware using a heuristic approach.
My reasoning is the following: While the attack vectors of ransomware may be of various kind, ranging from careless user action to zero day exploints, the action is always roughly the same: Lots and lots of files are opened, encrypted and then the encrypted file is stored in place of the orignal one.
I don't have deeper knowledge on the working principles of antivirus protection, but I am led to believe that this kind of action should be detectable relatively easy with a heuristic approach. One could for example watch for processes that perform mass reading and writing operations, with the output files typically having much higher entropy than the input files. Also, one could watch the currently running processes for sending instructions to the CPU, which appear to contain encryption steps. Although the latter is probably harder to achieve, I think it should be feasable given the rather small number of widely-spread encryption algorithms.
Without doubt, this would not provide perfect protection against ransomware. When the ransomware has started encrypting, it will take some time until the antivirus kicks in and there may already be some lost files. But of course, it will be better to lose some files instead of losing them all. Also there will be quite a number of false positives, which can be annoying for the user. Then again, some antivirus suites ask for any connected keyboard, whether it is really a keyboard and not some manipulated USB device, which I would consider as similarily annoying.
When searching online, the only similar approach I was able to find, is the software CryptoMonitor, which apparently has been aqcuired by Malware Bytes. But judging from the little info I was able to collect about it, however, it seems not to have hit the mass market. Also, I am not aware of any similar approaches from the known antivirus software vendors, or at least I could not find it.
This leads me to the conclusion that my idea for protection against ransomware is just not working. But why wouldn't a heuristic approach work in this case?