Backup File Encryption Heatmaps for Ransomware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing detection technologies cannot effectively determine whether a backup file has been ransomware-encrypted without parsing the backup file, as backup files have a binary structure with encrypted index data that cannot be cracked through conventional reverse engineering.
Innovation Solution
A method involving constructing an encryption heatmap using a color coding function and space filling curve to analyze the distribution of encrypted data in backup files, determining an encryption score, and performing time sequence anomaly detection on subsequences to identify ransomware-encrypted backup files without parsing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional reverse engineering is used to analyze backup files, then the index data can be extracted, but the detection accuracy is insufficient and resource consumption is high
Solution Approach 1:
The patent replaces conventional reverse engineering methods with a novel encryption heatmap analysis approach. Instead of mechanically parsing and reverse-engineering backup files, the system uses cryptographic analysis techniques to generate heatmaps that visualize encryption patterns, thereby improving detection accuracy while reducing computational resource consumption.
Solution Approach 2:
The patent employs color-coded heatmaps to represent different encryption states and patterns in backup files. By transforming cryptographic data into visual color representations, the system enables intuitive detection of ransomware-encrypted files without requiring resource-intensive parsing operations.
2Reliability
If backup files are parsed to detect encryption, then detailed file information can be obtained, but the detection time increases and real-time protection is compromised
Solution Approach 1:
The patent extracts only the essential cryptographic features from backup files to generate encryption heatmaps, rather than parsing the entire file structure. This selective extraction approach maintains detection reliability by focusing on encryption patterns while significantly reducing the time required for analysis.
Solution Approach 2:
The system performs preliminary cryptographic analysis on backup files to generate encryption heatmaps before actual detection is needed. This preliminary processing creates a ready-to-analyze visual representation that enables rapid detection without requiring time-consuming full file parsing when security events occur.
3Measurement precision
If encryption heatmap analysis is performed on all backup files, then detection coverage is improved, but computational complexity increases
Solution Approach 1:
The patent segments the backup file analysis process into distinct stages: generating encryption heatmaps from cryptographic data, analyzing color pattern distributions, and making detection decisions. This segmentation allows the system to apply computational resources efficiently at each stage, maintaining high detection precision without overwhelming computational complexity.
Data Source
AI summary
Embodiments of this application disclose a method for detecting a backup file and a related device. The method includes: obtaining an encryption heatmap of each of a plurality of backup files; determining an encryption score of the backup file based on distribution of a target color in the encryption heatmap; constructing a sequence from the encryption score of each backup file, and performing sampling on the sequence by using a sliding window, to obtain a plurality of subsequences; and performing time sequence anomaly detection on the plurality of subsequences, and determining that a backup file corresponding to an encryption score in an abnormal subsequence is ransomware-encrypted. In this way, it can be detected, without parsing the backup file, whether the backup file is ransomware-encrypted.