Clustered IO Threat Detection for Low-Latency Ransomware Response
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods in computing systems are time-consuming and can disrupt normal operations, with significant damage often occurring before detection, especially in the case of ransomware, which focuses on data changes rather than code signatures.
Innovation Solution
A datacenter-scale ransomware detection paradigm using interceptors and detectors in the data path to intercept IOs, allowing real-time or near-real-time malware detection through a cluster of detectors that analyze metadata and data streams, with options for synchronous, asynchronous, and out-of-band communication modes, and load balancing to manage detector workloads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional disk scanning methods are used to detect malware, then malware detection capability is provided, but detection time increases and normal disk operations are disrupted
Solution Approach 1:
The system creates and maintains content indexes of disk data in advance, organizing data into chunks with metadata before scanning is needed. This preliminary indexing allows rapid malware detection by comparing against known malware signatures stored in the index, eliminating the need to scan entire disks during detection events.
Solution Approach 2:
The patent extracts only the necessary portions of disk data (content indexes and relevant chunks) from the entire disk for analysis. Instead of scanning all disk contents, the system retrieves specific data blocks identified through the index, significantly reducing the volume of data that must be processed during malware detection.
2Measurement precision
If comprehensive disk scanning is performed to ensure thorough malware detection, then detection accuracy improves, but system performance and normal operations are degraded
Solution Approach 1:
The disk data is segmented into manageable chunks with associated metadata and content indexes. This segmentation allows the system to process and analyze only relevant data portions rather than treating the entire disk as a single unit, maintaining detection accuracy while improving system performance during scanning operations.
Solution Approach 2:
The content index serves as an intermediary structure between the raw disk data and the malware detection engine. The index pre-organizes data into searchable chunks with metadata, enabling the detection system to quickly locate and analyze only the relevant portions of disk contents without directly processing the entire disk, thus preserving system performance.
3Speed
If delta optimization is used to reduce scan data volume, then detection speed improves, but detection operations still require significant time and resources
Solution Approach 1:
The system performs preliminary indexing of disk contents into structured chunks with metadata before detection is needed. This advance organization eliminates the need to copy and process raw disk data during detection events, as the indexed chunks are already prepared for rapid analysis, significantly reducing detection time while maintaining speed improvements from delta optimization.
Data Source
AI summary
A detection engine for detecting threats to a computing system is disclosed. The detection engine includes a detector cluster and one or more interceptors. The interceptors are positioned at various locations in a data path of a computing system and configured to intercept IOs. The IOs, or portions thereof, are analyzed for threats by the detectors. Detectors in the detector cluster are each associated with at least one interceptor and each detector receives data streams from connected interceptors. When a threat is detected by a detector, a response may be initiated. The response may include sharing knowledge about the threat with other detectors in the detector cluster. In addition, interceptors may be redirected when a detector fails and detector workloads, such as number of connected interceptors, may be rebalanced.