Cloud File Ransomware Detection Using Change Velocity Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies lack effective methods to detect and respond to ransomware attacks on cloud-based file systems, particularly due to the large volume of files stored in the cloud and the difficulty in scanning each file for malware, and the challenge of inspecting content that is not visible to IT systems.
Innovation Solution
The use of an inspective agent that inspects recently updated content on cloud drives and an active agent that monitors real-time transactions, combined with a client agent installed locally, to identify patterns of malicious activity by analyzing historical and current content properties or metadata, and implement response mechanisms to restrict file modifications by the initiating machine or user.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Volume of moving object
If cloud-based file storage is used to increase storage capacity and accessibility, then storage capability is improved, but security against ransomware attacks deteriorates due to lack of visibility and control
Solution Approach 1:
The patent introduces an intermediary inspection system that acts as a mediator between cloud storage and user access. This intermediary component inspects file content properties and metadata to detect ransomware indicators without requiring direct user control over cloud storage, thereby maintaining storage accessibility while improving security detection capability
Solution Approach 2:
The patent replaces traditional mechanical scanning methods with automated content property analysis and machine learning-based detection systems. Instead of manual or simple file scanning, the system uses intelligent algorithms to analyze file characteristics, enabling effective ransomware detection without proportionally increasing computational resource consumption
2Reliability
If comprehensive file scanning is performed to detect ransomware, then detection capability is improved, but processing time and system resources consumed increase
Solution Approach 1:
The patent extracts only the most critical content properties and metadata for analysis rather than scanning every file completely. By identifying and examining only the essential characteristics that indicate ransomware infection, the system achieves effective detection while significantly reducing processing time and resource consumption
Solution Approach 2:
The patent performs preliminary inspection of file content properties and metadata before complete scanning. This preliminary action identifies potential ransomware indicators early in the process, allowing the system to either confirm suspicions with targeted scanning or rule out false positives quickly, thereby optimizing overall processing efficiency
3Ease of operation
If cloud storage is used to enable remote access and collaboration, then accessibility is improved, but visibility over content and control over sharing deteriorates
Solution Approach 1:
The inspection system serves as an intermediary layer that provides visibility into cloud storage content without interfering with normal access operations. It monitors and analyzes content properties and metadata to maintain information awareness while preserving the ease of remote access and collaboration features
Solution Approach 2:
The system implements feedback mechanisms that continuously monitor content properties and provide insights into storage activity. This feedback loop enables the system to maintain visibility over content and detect anomalies while allowing users to continue accessing and collaborating on files without interruption
Data Source
AI summary
The technology disclosed relates to detecting a data attack on a local file system. The detecting includes scanning a list to identify files of the local file system that have been updated within a timeframe, reading payloads of files identified by the scanning, calculating current content properties from the payload of the files, obtaining historical content properties of the files, determining that a malicious activity is in process by analyzing the current content properties and the historical content properties to identify a pattern of changes that exceeds a predetermined change velocity. Further, the detecting includes determining that the malicious activity is in process by analyzing the current content properties and known patterns of malicious metadata to identify a match between the current metadata and the known patterns of malicious metadata, determining a machine/user that initiated the malicious activity, and implementing a response mechanism that restricts file modifications by the machine/user.