File Server Ransomware Detection via ML Traffic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for detecting ransomware attacks in computer networks are inadequate due to their reliance on endpoint security agents that require extensive coverage and continuous updates, making it impossible to defend against increasing network complexity and zero-day attacks, leading to undetected attacks and encrypted files.
Innovation Solution
A method using machine learning algorithms to determine file-access patterns by training processors with datasets representing network traffic, identifying anomalies through normalized differences, and detecting ransomware properties based on communication patterns, allowing for real-time detection and adaptation without requiring extensive hardware or software modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If endpoint security agents are deployed to detect ransomware attacks, then detection capability is improved, but device complexity and implementation difficulty increase significantly
Solution Approach 1:
The patent introduces a file server as an intermediary component that mediates between endpoints and the detection system. Instead of deploying agents on every endpoint, the file server centrally monitors file access patterns, eliminating the need for complex endpoint agent deployment while maintaining detection capability.
Solution Approach 2:
The detection functionality is extracted from the endpoints and consolidated at the file server level. By removing the need for security agents on individual endpoints and centralizing the detection logic at the file server, the system reduces device complexity while preserving ransomware detection capabilities.
2Reliability
If continuous software updates are implemented to counter new attack signatures, then detection accuracy is improved, but loss of time and operational disruption increase
Solution Approach 1:
The system performs preliminary learning of normal file access patterns during a training phase before deployment. This preliminary action establishes a baseline model that enables continuous detection without requiring frequent updates, reducing maintenance time while maintaining detection accuracy.
Solution Approach 2:
The detection system continuously monitors and adapts to new file access patterns autonomously without requiring manual updates. The system serves itself by automatically adjusting to changing network conditions and file access behaviors, eliminating the need for time-consuming software updates.
3Reliability
If comprehensive endpoint coverage is attempted in large networks, then detection capability is improved, but device complexity and implementation difficulty become prohibitive
Solution Approach 1:
The patent merges the detection functionality into the file server that is already present in the network infrastructure. By combining file serving and security monitoring functions in a single component, the system achieves network-wide detection coverage without the operational complexity of deploying separate agents on numerous endpoints.
Solution Approach 2:
The file server performs multiple functions: it serves files to endpoints and simultaneously monitors file access patterns for ransomware detection. This multi-functionality eliminates the need for separate detection agents on each endpoint, making deployment easier while maintaining comprehensive coverage.
4Measurement precision
If traditional signature-based detection is used, then initial detection accuracy is improved, but adaptability to zero-day attacks deteriorates
Solution Approach 1:
The system dynamically adapts to new file access patterns by continuously learning from observed behavior. Instead of relying on static signatures, the detection model evolves with changing network conditions and file access behaviors, enabling detection of zero-day attacks while maintaining precision for known threats.
Solution Approach 2:
The system changes its detection parameters from fixed attack signatures to dynamic behavioral patterns. By monitoring file access frequency, timing, and patterns rather than relying on predetermined signatures, the system maintains detection precision for known attacks while gaining adaptability to novel zero-day threats.
Data Source
AI summary
Systems and methods of determining file-access patterns in at least one computer network, the network comprising a file-access server, including training a first machine learning (ML) algorithm with a first training dataset comprising vectors representing network traffic such that the first ML algorithm learns to determine network characteristics associated with file-access traffic, determining, using the first ML algorithm, network characteristics based on highest interaction of traffic with the file-access server compared to other interactions in the at least one computer network, and determining file-access patterns in the at least one computer network based on the network characteristics associated with file-access traffic.