Google has introduced a new AI tool designed for Drive for desktop. The model is said to be trained on millions of real ransomware samples and can pause syncing to reduce the damage from a ransomware attack.
Google Drive for desktop is an application designed to synchronize Drive with Windows and macOS, allowing you to keep local files in sync with cloud storage.
The developers say the new AI will look for indicators of ransomware (for example, attempts to encrypt or corrupt large numbers of files) and will be able to pause file synchronization, which will help prevent the malware from spreading more widely.
In case an attack is detected, the tool will send the user an email alert or a pop-up notification, and will also help restore files “in just a few clicks,” Google claims.
Reports say that the ability to restore is preserved even when working with “traditional software,” like Microsoft Windows and Office, rather than cloud-based solutions. In addition, the AI model continuously analyzes file changes and ingests threat information from VirusTotal, which in theory should help it detect even new attack variants.
The new feature is enabled by default, but administrators can disable it for end users if necessary. In addition, administrators can receive alerts about all detected instances of malicious activity.
According to Google representatives, the feature is already available in open beta at no additional charge for most commercial Workspace plans. Users will also get the ability to restore files at no additional cost.
The company emphasizes that AI will not prevent ransomware attacks (which on average cost each victim company more than $5 million), but will only help contain their spread.
“The primary task is to reduce the damage from ransomware attacks and prevent their spread across the network by means of a new layer of protection,” Google emphasizes.
Essentially, the new AI functionality is intended to help stop ransomware before it can do the main thing: damage important files and render them unusable.