Cloud Storage Malware Detection via User Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional ransomware detection systems in cloud storage systems often fail to accurately identify malware-impacted files, leading to potential data loss and require users to pay ransoms to recover encrypted files, with limited recourse if payments are not made in time.
Innovation Solution
A cloud storage system that uses a malware analysis engine to detect suspicious files by performing tests such as encryption status checks, file naming pattern analysis, and machine learning based on user feedback, generating a graphical user interface to notify users and confirm malware presence, thereby reducing false positives and enabling file restoration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional ransomware detection systems encrypt files and hold them for ransom, then file recovery is possible through payment, but users face data loss and financial harm with limited recourse if ransom is not paid in time
Solution Approach 1:
The system performs preliminary detection of ransomware-infected files before users are fully impacted. By analyzing file encryption patterns, naming conventions, and user feedback, the system proactively identifies compromised files and alerts users, enabling them to take preventive actions such as restoring from backups or isolating affected files before complete data loss occurs.
Solution Approach 2:
The system implements feedback loops where user confirmations about detected malware are used to improve future detection accuracy. When users confirm or deny malware detections, this feedback is incorporated into the detection algorithms, continuously refining the system's ability to distinguish between actual ransomware infections and false positives, thereby reducing both data loss and false alarms.
2Measurement precision
If the system performs comprehensive malware detection tests on all files, then detection accuracy improves, but computational resources and processing time increase
Solution Approach 1:
The system applies different detection strategies to different files based on local characteristics. High-risk files showing suspicious encryption patterns or naming conventions undergo comprehensive analysis, while low-risk files use lighter verification methods. This localized approach maintains high detection accuracy for critical files while reducing overall computational resource consumption across the entire file system.
Solution Approach 2:
The system performs partial detection on all files (using lightweight indicators like file extensions and naming patterns) and excessive/comprehensive detection only on suspicious files identified by the initial scan. This two-tiered approach ensures that computational resources are concentrated where they are most needed - on files with actual malware risk - rather than uniformly processing every file with full analysis.
3Measurement precision
If the system requests user confirmation for every detected malware case, then false positives are reduced, but user interaction time and system complexity increase
Solution Approach 1:
The system requests user confirmation only for detected malware cases that meet certain confidence thresholds or exhibit specific characteristics. High-confidence detections with clear ransomware indicators proceed directly to remediation without user input, while ambiguous cases or those with lower confidence scores trigger confirmation requests. This selective approach maintains high precision by confirming uncertain cases while reducing operational complexity by automating clear-cut situations.
Data Source
AI summary
A cloud storage server accesses a plurality of server-stored files of a cloud storage account of a client device. The cloud storage server determines that one or more server-stored files from the plurality of server-stored files are affected by a malware activity. The cloud storage server generates a graphical user interface that includes a detection notification and a confirmation request, the detection notification indicating a detected presence of malware in the one or more server-stored files and metadata corresponding to the one or more server-stored files, the confirmation request indicating a request for the client device to confirm the detected presence of malware in the one or more server-stored files. A confirmation response is received from the client device. The confirmation response identifies at least one of the one or more server-stored files and confirming the presence of malware activity in the identified server-stored files.