Backup Ransomware Detection via Statistical Filtering and Entropy Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting ransomware are inefficient and computationally expensive, particularly when dealing with large data volumes, leading to increased resource consumption and prolonged detection times on client devices.
Innovation Solution
A two-step approach involving statistical behavior analysis to identify anomalies in file activities followed by entropy detection on a selective portion of the backup, reducing the computational load on client devices by performing entropy detection only on flagged portions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If heuristic pattern analysis is performed to detect ransomware, then detection capability is improved, but resource consumption increases substantially
Solution Approach 1:
The patent segments the ransomware detection process into two distinct phases: a fast statistical behavior analysis phase that screens all files, and a slower entropy analysis phase that is applied only to suspicious files identified in the first phase. This segmentation allows the system to maintain high detection capability while dramatically reducing overall resource consumption by limiting intensive analysis to a small subset of files.
Solution Approach 2:
The patent applies partial action by performing entropy analysis (a computationally expensive operation) on only a portion of files rather than all files. The statistical behavior analysis serves as a filter to identify the specific subset of suspicious files that require intensive entropy analysis, thereby avoiding excessive resource consumption on files that are clearly benign.
2Measurement precision
If each file is screened individually to repair damages, then detection accuracy is improved, but detection time increases
Solution Approach 1:
The detection process is divided into two stages: initial statistical behavior analysis that quickly identifies suspicious files, and subsequent entropy analysis that provides definitive confirmation. This segmentation enables the system to process large numbers of files efficiently by focusing detailed analysis only on files that fail the initial statistical screening.
Solution Approach 2:
The statistical behavior analysis serves as a preliminary filtering step that identifies suspicious files before applying the more time-consuming entropy analysis. This preliminary action reduces the overall detection time by preparing a focused list of candidate files that require intensive analysis, rather than applying intensive analysis to all files.
3Reliability
If statistical behavior analysis is performed on all backup files, then detection coverage is improved, but computational load increases
Solution Approach 1:
The patent segments the computational workload by first applying lightweight statistical behavior analysis to all files, then applying heavy entropy analysis only to suspicious files. This segmentation maintains comprehensive detection coverage while managing computational load through progressive filtering.
Solution Approach 2:
The statistical behavior analysis acts as an intermediary filtering mechanism between the initial file set and the entropy analysis stage. It mediates the computational load by identifying and isolating only the suspicious files that require intensive entropy analysis, thereby reducing the overall computational burden on the system.
Data Source
AI summary
A server manager for detecting ransomware includes a server interface to retrieve, from a storage device, a backup of a plurality of files stored by a client device. A ransomware detection module includes a statistical filter to generate a standard pattern of file activities of the client device for a time period. A statistical behavior analysis is performed on the backup of the plurality of files based on the standard pattern to identify a portion of the backup corresponding to a statistical anomaly different from the standard pattern. The statistical anomaly corresponds to an abnormal file activity. An entropy detector generates an entropy score for the portion of the backup. The entropy score represents a randomness of a distribution of bits in a block of a file in the portion of the backup. It is determined whether the backup includes the ransomware based on the generated entropy score.