Adaptive Ransomware Detection Engine Reducing Resource Overhead
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Behavioral-based ransomware detection techniques consume significant computer resources and face challenges with high false positive and false negative rates, leading to performance degradation and unnecessary interventions.
Innovation Solution
An adaptive security engine monitors computational entities for behaviors associated with encrypting files or disabling backups, assigns potential ransomware categories, and initiates protection actions, continuously updating the ransomware score based on detected behaviors to tailor tracking and interpretation, reducing resource utilization and false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If behavior-based ransomware detection techniques are used, then detection effectiveness against zero-day and self-modifying threatware is improved, but computer resource consumption increases significantly
Solution Approach 1:
The patent segments behavior-based detection into two distinct phases: an initial categorization phase that monitors for high-level ransomware behaviors (file encryption, backup disabling) to classify threats into categories, and a subsequent specialized monitoring phase that applies category-specific heuristics. This segmentation reduces overall resource consumption by avoiding continuous application of all detection methods while maintaining high detection effectiveness through targeted monitoring.
Solution Approach 2:
The patent implements dynamic adjustment of monitoring intensity and heuristics application based on the assigned ransomware category. The system adapts its resource usage by applying different levels of scrutiny and detection methods depending on the threat category, thereby optimizing the balance between detection effectiveness and resource consumption.
2Reliability
If behavior-based ransomware detection techniques are used, then detection of zero-day and self-modifying threatware is improved, but false positive rate increases
Solution Approach 1:
The patent reduces false positives by segmenting detection into phases: initial categorization based on high-level behaviors, followed by application of category-specific heuristics. This segmented approach allows the system to refine its assessment progressively, reducing false positives by cross-referencing multiple behavioral indicators before confirming a threat.
Solution Approach 2:
The patent incorporates feedback mechanisms where detection results from one phase inform subsequent monitoring and heuristic application. The system continuously refines its threat assessment based on observed behaviors and category assignments, allowing it to adjust its detection sensitivity and reduce false positives through iterative evaluation.
3Measurement precision
If continuous monitoring of computational entities is performed, then ransomware detection accuracy is improved, but system performance degradation occurs
Solution Approach 1:
The patent implements periodic action by applying intensive monitoring and heuristic analysis only after initial ransomware behaviors are detected and a category is assigned. Rather than continuous high-intensity monitoring from the start, the system uses periodic, targeted monitoring phases that maintain detection accuracy while minimizing ongoing performance impact.
Solution Approach 2:
The patent dynamically adjusts monitoring intensity based on threat indicators. The system transitions from standard monitoring to enhanced category-specific monitoring only when ransomware behaviors are detected, thereby maintaining high detection accuracy during critical phases while preserving system performance during normal operation.
Data Source
AI summary
A security engine may use event-stream processing and behavioral techniques to detect ransomware. The engine may detect process behavior associated with encrypting a file, encrypting a storage device, or disabling a backup file, and may assign a ransomware category to the process based thereon. The engine may initiate protection actions to protect system resources from the process, which may continue to execute. The engine may monitor the process for specific behavior corresponding to its ransomware category. Based on the extent to which such specific behavior is detected, the engine may determine that the process is not ransomware, assign a ransomware subcategory to the process, or adjust the process's threat score. Monitoring of the process may continue, and the threat score may be updated based on the process's behavior. If the threat score exceeds a threshold corresponding to the ransomware category (or subcategory), a corresponding policy action may be initiated.