Cryptoware Overwrite Redirection for File Integrity Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cryptoware and other malicious code encrypt or destroy stored files, making data inaccessible and requiring ransom payment for decryption, with existing solutions failing to preserve file integrity during overwrite operations.
Innovation Solution
Redirect overwrite operations to a safe memory location, creating a mirror file to analyze the effects without compromising the original file, and determine if the operation is malicious, thereby preserving file integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If overwrite operations are performed directly on stored files to detect malicious code, then detection capability is improved, but file integrity is compromised
Solution Approach 1:
The patent creates a copy of the file at a safe memory location before performing overwrite operations. The copy is used for analysis while the original file remains protected, allowing detection of malicious code without compromising file integrity. This is implemented through creating a mirror file or duplicate in a protected memory region where overwrite operations can be safely performed and analyzed.
Solution Approach 2:
The patent introduces an intermediary safe memory location that acts as a buffer between the malicious overwrite operation and the original file. This intermediary space allows the system to intercept and analyze overwrite operations before they reach the original file, enabling detection while preserving integrity. The safe memory location serves as a mediator that absorbs the harmful effect.
2Measurement precision
If analysis is performed on the original file during overwrite operations, then detection accuracy is improved, but system performance deteriorates
Solution Approach 1:
Instead of analyzing the original file during overwrite operations, the patent creates a copy in safe memory and performs analysis on this copy. This approach maintains detection accuracy while improving system performance, as the analysis operations do not block or slow down the original file operations. The copy serves as a separate analysis target that does not impact system productivity.
3Reliability
If safe memory location is used for overwrite operations, then file integrity is preserved, but memory usage increases
Solution Approach 1:
The patent creates copies of files in safe memory locations only when needed for analysis, rather than maintaining permanent duplicates. This temporary copying approach preserves file integrity while minimizing memory usage, as the copy is created only during the analysis window and can be discarded afterward. The system manages memory efficiently by creating copies on-demand rather than maintaining constant duplicates.
Data Source
Figure 1
Figure 2
AI summary
A computer implemented method for protecting data stored in at least one file from being overwritten by malicious code, comprises: monitoring at least one file stored in a storage device location to detect a request to perform an overwrite operation at least a portion of data of the at least one file; redirecting the overwrite operation to a memory location designated as safe for being overwritten; analyzing the overwrite operation at the memory location to identify an association with malicious code; and outputting an indication of an attempt to overwrite the at least one file by malicious code.