Encrypted File Correlation Using Controlled Malware Detonation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data protection platforms face challenges in deriving insights from encrypted data due to a lack of visibility, making it difficult to detect and respond to cyber threats effectively, especially in encrypted files.
Innovation Solution
An AI-powered platform for endpoint detection and response (EDR) and data protection correlation (DPC) that enables pattern-based event correlation, providing insights into encrypted data by decrypting suspicious files in a controlled environment and determining their impact on the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data encryption is implemented to protect data from cyber threats, then data security is improved, but visibility into data state is lost making event correlation impossible
Solution Approach 1:
The patent introduces an intermediary decryption component that temporarily decrypts encrypted data to enable event correlation analysis. This mediator allows the system to inspect data content without permanently compromising security, as the data remains encrypted during storage and transmission. The intermediary enables the correlation engine to access plaintext for analysis while maintaining the encrypted state in the data protection platform.
2Reliability
If encrypted data is stored in data protection platforms, then data protection is improved, but the data becomes off-limits for interrogation and pattern analysis
Solution Approach 1:
The system performs preliminary decryption of encrypted data before event correlation analysis. By decrypting data in advance of the correlation process, the system enables pattern recognition and event analysis on the plaintext content. The decrypted data is then re-encrypted after analysis, maintaining protection while enabling detection capabilities.
3Measurement precision
If AI pattern discovery is applied to encrypted data, then malware detection capability is improved, but decryption and testing in controlled environments increases system complexity
Solution Approach 1:
The patent segments the system into distinct functional components: an AI pattern discovery module that identifies potential malware patterns, a controlled testing environment that safely executes suspicious files, and a data protection platform that manages encryption. This segmentation allows each component to specialize in its function, improving malware detection while organizing system complexity into manageable modules with defined interfaces.
Data Source
AI summary
Various methods, apparatuses, systems, and media for implementing endpoint detection and response and data protection correlation are disclosed. A correlation engine receives a data stream from multiple sources and one or more patterns. A processor analyzes the data to relate an event to the one or more patterns and executes a policy when the event matches the one or more patterns to identify suspected encrypted data files. The processor transfers the suspected encrypted data files and an encryption key to a controlled testing environment to use the encryption key to safely decrypt the suspected encrypted data files and to test the suspected encrypted data files to determine a potential network impact of executing each of the suspected encrypted files on the network. The processor detonates, from the controlled testing environment, the suspected data files confirmed during the testing to have a negative impact on the network.