Multi-Judge Cloud File Trust Scoring for Ransomware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cybersecurity threats such as ransomware evade modern security tools by delivering files within a computing environment, leading to problematic files being stored or accessed without adequate characterization of their trustworthiness.
Innovation Solution
A file analysis and scoring system utilizing an analysis engine and judgment engine with machine learning models to determine trustworthiness scores, which are tailored to individual endpoints or tenants, and trigger remediation actions based on these scores.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security tools are used to detect ransomware, then the security tools may identify known threats, but sophisticated ransomware can evade detection by delivering files within legitimate computing environments
Solution Approach 1:
The system segments the detection process into multiple independent judges (static analysis, dynamic analysis, heuristic analysis) that each evaluate different aspects of file behavior. This segmentation allows comprehensive detection without relying on a single vulnerable detection method, thereby maintaining reliability against sophisticated evasion techniques.
Solution Approach 2:
The system performs preliminary analysis actions by evaluating files at upload time before they can execute malicious activities. The analysis engine examines file attributes, behaviors, and characteristics proactively, generating trustworthiness scores that prevent malicious files from being stored or accessed, thus countering evasion before it can occur.
2Measurement precision
If comprehensive file analysis is performed to characterize trustworthiness, then detection capability improves, but system complexity increases due to multiple judges and analysis engines
Solution Approach 1:
The system merges multiple analysis engines and judges into a unified file analysis platform that processes files through coordinated evaluation stages. The analysis engine consolidates outputs from static analysis, dynamic analysis, and heuristic analysis into a single trustworthiness score, reducing architectural complexity while maintaining comprehensive measurement precision.
Solution Approach 2:
The analysis engine serves as an intermediary that mediates between multiple judges and the final trustworthiness determination. It receives evaluation results from various judges, synthesizes this information, and produces a unified trustworthiness score, thereby simplifying the interaction between complex components and reducing system complexity.
3Reliability
If multiple judges execute different machine learning models to determine trustworthiness scores, then detection accuracy improves, but processing time increases
Solution Approach 1:
The system implements periodic action by executing judges in structured phases (static analysis phase, dynamic analysis phase, heuristic analysis phase) rather than simultaneously. This phased approach allows each judge to operate independently in its optimal time window, improving reliability through comprehensive evaluation while managing processing time through organized sequencing.
Solution Approach 2:
The system performs preliminary filtering and evaluation actions in early stages before committing to more time-consuming analysis. The analysis engine quickly assesses basic file attributes and characteristics first, then proceeds to more intensive analysis only when necessary, thereby maintaining high reliability while minimizing unnecessary processing time for clearly benign or obviously malicious files.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A notification message is received indicating an upload of a file to a cloud service. An analysis engine (which can execute one or more machine learning models or other analysis operations) can generate information that characterizes the file which can be indicative of a level of trustworthiness for the file. In response to the generated information, each of a plurality of judges are notified to commence or revisit a judging process. In response to the notifications, the judges (which can execute one or more machine learning models or other analysis operations) retrieve the generated information and determine a respective trustworthiness score for the file. These scores can be stored in a corresponding judge database and/or data can be provided which characterizes the determined trustworthiness scores to a consuming application or process. Related apparatus, systems, techniques and articles are also described.