Backup Stream Ransomware Detection Using Deduplication Shifts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting and preventing ransomware attacks in enterprises are inadequate as they often require special installations, are not real-time effective, and can lead to significant data loss and operational disruptions, especially in large systems.
Innovation Solution
A system that monitors data write operations and replicates them to a recovery site, analyzing parameters such as deduplication and compression ratios to detect unintended encryption, allowing for real-time detection and prevention of ransomware attacks by preventing further writes to the recovery site while maintaining a clean copy of data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ransomware detection utilities are installed in application hosts, then detection capability is improved, but device complexity and ease of operation deteriorate due to requiring special installation in every host
Solution Approach 1:
The patent introduces a backup system as an intermediary that performs ransomware detection without requiring installation in application hosts. The backup system intercepts and analyzes backup data streams, using deduplication ratio analysis to detect encryption patterns indicative of ransomware attacks. This mediator approach maintains detection capability while eliminating the need for complex host-level installations.
2Ease of operation
If backup-based detection is used, then ease of operation is improved, but productivity deteriorates because backup is performed only periodically rather than in real time
Solution Approach 1:
The system performs preliminary analysis of backup data streams by continuously monitoring deduplication ratios as data is being backed up. Rather than waiting for periodic backup completion, the system analyzes the backup stream in real-time during the backup process itself, enabling detection before the attack completes while maintaining operational simplicity.
3Reliability
If I/O activity monitoring is used, then detection capability is improved, but reliability deteriorates because high I/O traffic has many different causes unrelated to ransomware
Solution Approach 1:
The patent shifts the detection parameter from raw I/O traffic volume to deduplication ratio analysis. By measuring how efficiently data compresses during backup and detecting abnormal changes in this ratio, the system identifies ransomware encryption patterns without being confounded by legitimate high-I/O operations. This parameter transformation significantly reduces false positives while maintaining detection accuracy.
Data Source
AI summary
In a system that replicates data writes by a server to form a local copy for a local production site with local storage and a remote copy for a remote recovery site having remote storage, ransomware is detected by a decrease of more than a predetermined threshold in either or both of compression ratio or deduplication ratio in a length of data selected by a sliding time window. Upon detecting ransomware, data writes to said remote storage are stopped to minimize corruption of the remote data.