Anomaly and Ransomware Detection via Snapshot Metadata
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity measures, particularly signature-based approaches, are inadequate for detecting ransomware due to its ability to evolve and evade detection, while machine learning-based solutions can be computationally expensive and resource-intensive.
Innovation Solution
A hybrid-cloud architecture-based system that leverages machine learning to detect anomalies and ransomware in data backups, utilizing snapshot metadata to minimize computational overhead and offloading significant processing to a cloud-based SaaS platform.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If machine learning-based behavioral analysis is used to detect ransomware, then detection reliability is improved, but computational cost increases
Solution Approach 1:
The system segments the computational workload by separating data collection (snapshot metadata generation) from model training and inference. The backup system collects metadata with minimal overhead, then a separate training system processes this data offline to train machine learning models, which are later deployed for efficient anomaly detection.
Solution Approach 2:
The system performs preliminary actions by collecting and storing snapshot metadata from backup operations before ransomware detection is needed. This pre-collected metadata serves as training data for machine learning models, enabling fast detection without requiring real-time computational resources during actual security events.
2Use of energy by moving object
If snapshot metadata is used for training data, then computational overhead on production systems is reduced, but detection precision may be impacted
Solution Approach 1:
The system uses snapshot metadata as an intermediary representation of file system state. Instead of analyzing actual file contents or real-time system operations, the metadata captures essential characteristics (file creation, modification, deletion patterns) that serve as proxies for detecting anomalous behavior while minimizing impact on production systems.
Solution Approach 2:
The system creates copies of file system state information through snapshot metadata rather than analyzing the actual files or real-time operations. These metadata copies contain sufficient information for training detection models without requiring access to or processing of the original production data, thus isolating the analytical workload from the production system.
3Use of energy by moving object
If cloud-based SaaS platform is used for processing, then computational stress on primary machine is reduced, but system complexity increases
Solution Approach 1:
The cloud-based SaaS platform acts as an intermediary that receives snapshot metadata from the backup system, performs model training and analysis, and returns detection results. This intermediary architecture offloads computational stress from the primary machine while providing a clear, standardized interface that manages the complexity of cloud integration.
Data Source
AI summary
Some examples relate generally to computer architecture software for information security and, in some more particular aspects, to machine learning based on changes in snapshot metadata for anomaly and ransomware detection in a file system.