Entropy-Based Ransomware Detection and Backup Retention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing ransomware detection methods, such as using tripwire files, are ineffective in early detection of unauthorized encryption, allowing files to be encrypted over time and potentially overwritten, leading to data loss, especially when sophisticated ransomware avoids encrypting tripwire files or prevents backup processes.
Innovation Solution
A system that calculates entropy indicators for data collections using methods like Shannon entropy, chi-squared distribution, or histograms to detect unauthorized encryption by comparing entropy levels over time, allowing for early detection and retention of unencrypted backups, while continuing to back up unencrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If tripwire files are used to detect unauthorized encryption, then detection capability is provided, but detection timing is delayed and sophisticated ransomware can avoid detection
Solution Approach 1:
The patent extracts the detection function from specific tripwire files and applies it to all files through entropy calculation. Instead of monitoring only selected files, the system calculates entropy indicators for every file to detect encryption, ensuring comprehensive and timely detection without relying on ransomware avoiding specific files.
Solution Approach 2:
The patent uses entropy as a parameter to detect encryption. By calculating entropy indicators and comparing them against thresholds or historical values, the system can identify encrypted files based on their statistical properties rather than relying on file content or specific file markers that ransomware might avoid.
2Reliability
If tripwire file detection is implemented, then unauthorized encryption can be detected, but backup operations are prevented to avoid overwriting unencrypted backups
Solution Approach 1:
The patent applies partial action by selectively preventing backups only for files identified as encrypted through entropy analysis, while allowing continuous backup operations for unencrypted files. This approach maintains backup safety for vulnerable files without halting the overall backup process, thus preserving productivity.
Solution Approach 2:
The system uses entropy calculation results as feedback to control backup operations. By continuously monitoring entropy indicators and comparing them against encryption thresholds, the system dynamically adjusts backup behavior, preventing backups only when encryption is detected while allowing normal backups when files are unencrypted.
3Loss of time
If all files are monitored for encryption, then early detection is achieved, but system complexity and computational overhead increase
Solution Approach 1:
The patent employs self-service by leveraging the inherent statistical properties of encrypted data (high entropy) to enable automatic detection without complex analysis. The entropy calculation method is computationally efficient and can be performed on all files with minimal overhead, allowing comprehensive monitoring without proportionally increasing system complexity.
Data Source
AI summary
A first entropy indicator is calculated at a first time for a collection of data stored in at least one memory. A second entropy indicator is calculated at a second time for the collection of data. The first entropy indicator is compared with the second entropy indicator. Based on the comparison, it is determined whether to back up the collection of data and/or whether to retain an earlier backup of the collection of data.