Block-Based Ransomware Detection and State Restoration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for managing ransomware attacks are reactive and slow, leading to extended data unavailability and potential substantial data loss, as they rely on identifying and restoring clean backups, which can be time-consuming.
Innovation Solution
A proactive technique that identifies blocks written to a data object between two points in time, determines attributes of these blocks, and secures the data object's state if ransomware is likely, allowing for prompt detection and restoration to a previous state, using snapshot technology or asynchronous replication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If reactive backup restoration is used to respond to ransomware attacks, then data can be recovered, but data unavailability time is extended and data loss may occur
Solution Approach 1:
The system performs preliminary actions by continuously monitoring block write patterns and maintaining secure copies of data objects at previous time points before ransomware encryption completes. This proactive approach allows immediate restoration without waiting for attack detection and backup verification, thus reducing data unavailability time while maintaining reliable data recovery capability
2Measurement precision
If detailed analysis of backups is performed to identify clean backups, then data integrity can be verified, but the process is slow and time-consuming
Solution Approach 1:
The system performs preliminary analysis by monitoring block write patterns in real-time and identifying suspicious activity before encryption completes. Secure copies are created at previous time points based on this preliminary detection, enabling fast restoration without requiring detailed post-attack backup analysis, thus improving restoration speed while maintaining verification accuracy
Solution Approach 2:
The system skips the time-consuming process of detailed backup analysis by using continuous block pattern monitoring to identify attacks in progress. This allows the system to rush through to restoration by using pre-prepared secure copies from before the attack, significantly improving productivity while maintaining sufficient verification through pattern recognition
3Speed
If block-based monitoring is implemented to detect ransomware patterns, then detection speed is improved, but storage resource consumption increases
Solution Approach 1:
The system extracts only the essential block write pattern information needed for ransomware detection, rather than monitoring or storing complete file contents. By focusing on metadata and block-level changes, the system achieves fast detection speed while minimizing storage resource consumption through selective data extraction
Data Source
AI summary
A technique of protecting data from ransomware attacks identifies a set of blocks written to a data object between first and second points in time, determines a set of attributes of the set of blocks, and, in response to the set of attributes indicating a likelihood of a ransomware attack, secures a state of the data object as of the first point in time.