Anti-Ransomware File Access Unit Entropy Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ransomware attacks pose a significant threat to data security by encrypting files, making them inaccessible unless a ransom is paid, and existing solutions are inadequate in differentiating between regular and compromised files, leading to potential data loss and costly downtime.
Innovation Solution
Implementing an anti-ransomware file access unit that determines the entropy value of files and performs a copy-on-write process if the entropy value exceeds a threshold, writing the file to a copy-on-write storage area to preserve the original unencrypted file, thereby preventing unauthorized encryption and allowing for easy recovery.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ransomware encrypts files to prevent unauthorized access, then data security is improved, but data accessibility deteriorates
Solution Approach 1:
The system performs preliminary actions by creating backup copies of files before they are encrypted by ransomware. The file access unit intercepts write operations, creates backup copies in a protected storage area, and maintains these backups even after the original files are encrypted, ensuring data recovery is possible without paying ransom.
Solution Approach 2:
The invention uses copying by creating duplicate copies of files in a protected storage area. The file access unit generates backup copies of files being written to storage, storing them with different metadata. These copies serve as recovery versions when ransomware encrypts the original files, resolving the contradiction between security (encryption) and accessibility (recovery).
2Ease of operation
If backups are generated regularly to restore encrypted files, then data accessibility is improved, but the likelihood of outdated data increases
Solution Approach 1:
The system implements feedback by continuously monitoring file write operations and immediately creating backup copies when changes are detected. The file access unit intercepts each write operation, creates an updated backup copy, and maintains a chain of versions. This real-time feedback mechanism ensures backups are always current without requiring scheduled backup intervals, resolving the contradiction between accessibility and data currency.
3Measurement precision
If entropy analysis is performed on all files to detect ransomware, then detection precision is improved, but processing time increases
Solution Approach 1:
The system applies partial action by performing entropy analysis selectively rather than on all files uniformly. The file access unit focuses entropy detection resources on files that are being written to storage, analyzing only those files at the point of write operation. This partial application of entropy analysis maintains high detection precision for ransomware while minimizing overall processing time by not analyzing every file in the system continuously.
Data Source
AI summary
A method and a related system for a protection against unauthorized file encryption in a file system may be provided. The method may comprise providing an anti-ransomware file access unit, determining, by the anti-ransomware file access unit, an entropy value for a portion of a file to be written to the file system, and upon determining that the entropy value is equal or above a threshold value, performing a copy-on-write process to the file to be written, whereby the file is written to a copy-on-write storage area.