File Server Ransomware Protection via Entropy Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ransomware attacks pose a significant threat to file servers by encrypting files, making it difficult to protect against various types of implementations targeting different platforms and methods, which existing technologies have struggled to adequately address.
Innovation Solution
A system and method that assigns a session identifier to remote sessions, monitors operations, creates volume-level snapshots when suspicious activity is detected, uses machine learning to classify danger levels, and interrupts sessions when entropy thresholds are exceeded, restoring data to a previous state and blocking malicious users and IP addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional ransomware protection methods are used, then some level of protection is provided, but they fail to adequately protect against various types of ransomware attacks targeting different platforms and methods
Solution Approach 1:
The system implements a universal protection mechanism that monitors file operations across multiple platforms and ransomware types through a centralized file server approach. The file server acts as a universal endpoint that can handle different ransomware threats regardless of their specific implementation, providing multi-functional protection against encryption, deletion, and modification attacks.
Solution Approach 2:
The system creates snapshots of file states before suspicious operations occur and prepares restoration capabilities in advance. When ransomware activity is detected, the system can immediately restore files from pre-captured snapshots without waiting for damage to complete, effectively preventing the harmful action rather than just responding to it.
2Measurement precision
If comprehensive monitoring and analysis of file operations is performed to detect ransomware, then detection accuracy improves, but system complexity and processing overhead increase
Solution Approach 1:
The monitoring system is segmented into distinct functional components: snapshot creation, entropy calculation, pattern matching, and restoration. Each component handles a specific aspect of ransomware detection, allowing the system to achieve comprehensive monitoring without overwhelming complexity. The file server divides responsibilities between monitoring, analysis, and recovery functions.
Solution Approach 2:
The system creates copies of file states through snapshots rather than continuously analyzing original files. This copying approach allows comprehensive monitoring of file operations without directly interfering with or complicating the original file structures. Entropy analysis is performed on copied data rather than original files, reducing system complexity.
3Speed
If snapshots are created frequently to enable rapid restoration, then restoration speed improves, but storage requirements and system resources increase
Solution Approach 1:
The system creates snapshots periodically based on monitored file operations rather than continuously or at fixed time intervals. Snapshots are taken when suspicious patterns are detected or when significant file changes occur, providing rapid restoration capability when needed while avoiding unnecessary storage consumption during normal operations.
Solution Approach 2:
The snapshot storage system allocates resources locally based on actual needs rather than uniformly across all files. The system stores snapshots selectively for files that are at risk or have been modified, rather than creating identical backup copies of all files on the system, thereby reducing overall storage requirements while maintaining restoration speed for critical files.
Data Source
AI summary
A method is provided for protecting a file server from a ransomware attack. An exemplary method comprises assigning a session identifier to a remote session initiated with the file server, monitoring operations associated with the session identifier, determining whether the operations are suspicious according to a policy, creating a volume-level snapshot of files on the file server, determining that encryption of the data is occurring when entropy of the monitored data is growing faster than the predetermined threshold rate, classifying the remote session as having a calculated degree of danger when the operations match operations contained in previously observed suspicious behavior patterns, interrupting the remote session when a combination of the degree of danger and the entropy is greater than a predetermined threshold value and restoring the data on the file server using the volume-level snapshot to a state prior to the encryption and dangerous activity.