Filename Extension Embedding for Unknown Ransomware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to accurately detect and prevent ransomware attacks that employ randomized modifications to file properties, such as filename extensions, due to the inability to generalize filenames or extensions used by newer, unrecognized ransomware families or versions.
Innovation Solution
Employ a machine learning model, specifically a Convolutional Neural Network (CNN), to create feature vectors from file properties like filenames and extensions, generating embedding representations for classification, distinguishing between benign and malicious modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional file detection methods are used, then known ransomware can be detected, but newer ransomware variants with randomized file properties cannot be detected
Solution Approach 1:
The patent transforms file properties (names, extensions, paths) into numerical parameter representations through embedding models. This allows the system to analyze and compare file properties mathematically, detecting anomalies that indicate ransomware activity regardless of specific filenames or extensions used by different ransomware variants.
Solution Approach 2:
The patent replaces traditional rule-based detection mechanisms with a machine learning model (CNN). This substitution enables the system to automatically learn patterns from training data and generalize to new ransomware variants without requiring explicit rules for each variant, thereby improving both reliability and adaptability.
2Object-affected harmful factors
If file properties are randomized by ransomware, then detection becomes more difficult, but security prevention is still needed
Solution Approach 1:
The patent introduces embedding representations as an intermediary layer between raw file properties and the detection model. This intermediary transforms variable-length, heterogeneous file property data into fixed-length numerical vectors, making the data suitable for CNN processing and enabling effective detection despite property randomization.
Solution Approach 2:
The patent segments file properties into distinct components (filename, extension, path) and processes each separately through embedding models before combining them. This segmentation allows the system to capture specific patterns in each component while maintaining overall file identity, improving detection capability against randomized properties.
Data Source
AI summary
A feature vector is created that comprises a plurality of values, each representing a corresponding portion of a filename extension for a digital file. During an inference workflow of a neural network model, an embedding vector is created that represents, in a meaningful way, the feature vector for the filename extension. A class label prediction value is then computed, based on an evaluation of the embedding vector, a first plurality of embedding vectors representing a plurality of feature vectors for a plurality of benign filename extensions, and a second plurality of embedding vectors representing a plurality of feature vectors for a plurality of malicious filename extensions. A prediction as to whether the digital file has been renamed by a malicious computer program is made, based on the class label prediction value.