Entropy Driver Detection for Ransomware-Resilient Client File Backups
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems are inadequate in protecting data from ransomware attacks on client computing devices, particularly when backups are compromised, leading to data loss and extortion risks.
Innovation Solution
Implementing an entropy-based detection system with an entropy driver and volume driver to identify file modifications, backing up affected and unaffected files to secondary storage and secure cloud storage, and enabling user review and management of backed-up files to mitigate ransomware threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional backup systems are used, then data can be recovered from backups, but the backups themselves can be compromised by ransomware leading to complete data loss
Solution Approach 1:
The system segments backup storage into multiple isolated volumes or partitions. By dividing the backup infrastructure into separate segments, ransomware that compromises one volume cannot access or encrypt other volumes, thereby maintaining backup reliability even when partial compromise occurs.
Solution Approach 2:
The system introduces an intermediary verification layer that scans backup data for ransomware indicators before restoration. This intermediary mechanism detects malicious modifications in backups and prevents restoration of compromised data, ensuring that only clean backup versions are recovered.
2Difficulty of detecting and measuring
If entropy-based detection is implemented to identify file modifications, then ransomware detection capability is improved, but system complexity increases
Solution Approach 1:
The system implements self-service by automatically calculating entropy values for file data and comparing them against baseline entropy profiles without requiring manual analysis. The detection mechanism autonomously identifies ransomware modifications by measuring statistical properties of file content, eliminating the need for complex manual inspection procedures.
Solution Approach 2:
The system changes the detection parameter from traditional virus signature matching to statistical entropy measurement. By using entropy values as the key detection parameter, the system can identify ransomware modifications based on statistical anomalies in file data patterns, simplifying the detection logic while improving effectiveness.
3Reliability
If all files are backed up to secondary storage, then data protection coverage is maximized, but storage requirements and time to backup increase
Solution Approach 1:
The system applies partial action by selectively backing up only critical files and folders identified through entropy-based risk assessment. Instead of backing up all data, the system prioritizes protection of files with highest ransomware risk based on their entropy characteristics and business importance, reducing storage requirements while maintaining adequate protection coverage.
Data Source
AI summary
A client computing device includes an entropy driver and a volume driver for protecting the client computing device against potential ransomware. The entropy driver is configured to determine one or more entropy values for a file in response to a determination that the file has been modified or changed. The determined entropy value may then be compared with a known entropy value for a filetype of the changed or modified file. Where the known entropy value and the determined entropy value differ, the volume driver may engage one or more protection operations to secure the client computing device from further corruption and/or modifications by potential ransomware and/or malware. The protection operations may include revoking and/or restricting one or more permissions on one or more storage volumes of the client computing device and backing up one or more files of the client computing device to secondary storage.