Backup File Ransomware Detection via Encryption Heatmap Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing detection technologies cannot effectively determine whether a backup file has been ransomware-encrypted without parsing the backup file, as backup files have a binary structure with encrypted metadata, making direct analysis difficult.
Innovation Solution
A method using an encryption heatmap to assess the distribution of encrypted data in backup files, determining an encryption score, and performing time sequence anomaly detection on subsequences to identify ransomware-encrypted files without parsing, employing randomness tests, color coding, and space filling curves.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If manual testing methods are used to verify backup files, then testing thoroughness can be maintained, but testing efficiency and speed are severely limited
Solution Approach 1:
The patent creates a virtual copy of the backup environment by establishing a virtual machine and mounting the backup file within it. This virtual copy allows automated testing without affecting the original backup, enabling efficient validation while maintaining testing thoroughness through programmatic control of the virtual environment.
Solution Approach 2:
The patent introduces an intermediary automated testing system that acts as a mediator between the backup file and manual verification. This intermediary uses scripting languages to automatically execute testing operations in the virtual machine, bridging the gap between automated efficiency and reliable validation.
2Productivity
If automated testing scripts are implemented, then testing speed increases, but handling complex backup scenarios becomes difficult
Solution Approach 1:
The patent implements dynamic adaptability by allowing the automated testing system to flexibly configure virtual machine parameters and testing operations based on the specific backup file being tested. The system can adjust to different backup types, sizes, and formats, making the automated process versatile enough to handle complex scenarios while maintaining high testing speed.
3Reliability
If extensive backup file testing is performed, then data security and reliability are improved, but time consumption and resource usage increase
Solution Approach 1:
The patent performs preliminary actions by automatically executing comprehensive testing operations in advance within the virtual machine environment. By pre-configuring the virtual machine and automatically running validation tests before actual backup restoration, the system ensures data reliability is verified beforehand, reducing the need for time-consuming manual testing later.
Data Source
Figure 1a
Figure 1b
Figure 2
AI summary
Embodiments of this application disclose a method for detecting a backup file and a related device. The method includes: obtaining an encryption heatmap of each of a plurality of backup files; determining an encryption score of the backup file based on distribution of a target color in the encryption heatmap; constructing a sequence from the encryption score of each backup file, and performing sampling on the sequence by using a sliding window, to obtain a plurality of subsequences; and performing time sequence anomaly detection on the plurality of subsequences, and determining that a backup file corresponding to an encryption score in an abnormal subsequence is ransomware-encrypted. In this way, it can be detected, without parsing the backup file, whether the backup file is ransomware-encrypted.