File-Level Attack Mitigation for Ransomware Source Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems struggle to identify the source of ransomware attacks at the block level, leading to the necessity of taking the entire volume offline, which affects all clients and causes dissatisfaction.
Innovation Solution
Implementing intrusion detection and mitigation at the file system level, utilizing a common layer that provides granular data to identify the source of attacks, allowing for targeted blocking of specific clients or IP addresses, rather than shutting down the entire volume.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If intrusion detection is performed at the block level, then the system can detect attacks, but the entire volume must be taken offline affecting all clients
Solution Approach 1:
The patent segments the storage system from block level to file level, where each file or directory can be independently monitored and protected. This allows the system to isolate and block only the specific file or client involved in an attack, rather than taking the entire volume offline, thus maintaining service availability for other clients while still providing comprehensive attack detection.
2Reliability
If the entire volume is taken offline to mitigate an attack, then the attack is stopped, but all clients are affected causing dissatisfaction
Solution Approach 1:
The patent implements local quality by applying different security actions to different files or clients within the same volume. The system can identify the specific source of an attack and apply mitigation measures (such as blocking or quarantining) only to that specific file or client, while allowing other files and clients to continue operating normally. This localized approach maintains service continuity for legitimate clients while effectively stopping the attack.
3Measurement precision
If file system level detection is implemented, then the source of attacks can be precisely identified, but the system complexity increases
Solution Approach 1:
The patent introduces an intermediary component that sits between the file system and the intrusion detection system. This intermediary layer translates file system operations into detectable events without requiring fundamental changes to either the file system or the detection system. By using this intermediary approach, the system achieves precise attack source identification through file-level metadata and operation tracking while avoiding the complexity of completely redesigning the storage architecture.
Data Source
AI summary
Architectures and techniques are described that can provide file system level attack mitigation techniques for a data storage service system or other network service system. By operating at a file system level, the disclosed techniques can access information that is unavailable at the block volume level and which can be leveraged to accurately identify a source of a potential attack. By accurately identifying a source of the potential attack, additional options are available for mitigating the potential attack.