File Share Threat Detection via Backup and Session Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions are ineffective in reliably and efficiently detecting file share-related threats and handling ransomware outbreaks in shared file environments.
Innovation Solution
A method and arrangement that intercepts file access attempts in monitored locations, creates backup copies, allows access, checks for file corruption after access, tracks user sessions, and blocks access if a predefined number of files become corrupted, restoring files from backups.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If prior art solutions are used for ransomware detection in shared folders, then basic threat detection is provided, but reliable and efficient detection of file share-related threats is not achieved
Solution Approach 1:
The system creates backup copies of files before allowing user access to shared folders. This preliminary action ensures that if ransomware encrypts files, the original unencrypted versions are preserved, enabling reliable detection and recovery while maintaining efficient operation without requiring complex real-time analysis of encrypted files
Solution Approach 2:
The system monitors file access patterns and corruption events in real-time, tracking the number of corrupted files per user session. When a threshold is exceeded, the system automatically blocks the user account. This feedback mechanism provides reliable threat detection while maintaining efficiency through automated responses rather than manual intervention
2Reliability
If all file access attempts are monitored and checked for corruption, then file share-related threats are detected, but system performance and user productivity are degraded
Solution Approach 1:
The system performs corruption checks selectively rather than on every single file operation. By monitoring corruption events and tracking them per user session, the system applies partial action - only initiating full corruption analysis when suspicious patterns emerge, thereby maintaining reliable threat detection while preserving system performance and user productivity
3Reliability
If backup copies are created for every file access attempt, then file restoration capability is improved, but storage space and processing overhead increase
Solution Approach 1:
Backup copies are created in advance before file access is granted, ensuring restoration capability is immediately available if ransomware attacks occur. This preliminary backup action provides reliable file recovery without requiring complex real-time backup processes, and the system manages storage efficiently by only maintaining backups for actively monitored shared files
Data Source
AI summary
An arrangement and a method, e.g. a computer implemented method, for preventing file share related threats in a computer, such as a server (2), or computer network, wherein the method comprises: intercepting an attempt to access a file, such as an attempt to modify, create, rename and/or delete a file, in a monitored location of a computer file system, e.g. in a folder (4) on a server, determining a user identification of a user, such as a remote user, attempting to access the file, creating a backup copy of the file, allowing the attempt to access the file in a monitored location of computer file system, e.g. in a shared folder (4), after creation of the backup copy of the file, checking corruption of the file after access to file by the user is closed, tracking of multiple accessed files within the same user session based on the determined user identification, and if more than a predefined number of files become corrupted by the same user identification, blocking access of the user to the computer, such as a server (2), and restoring the accessed and/or changed files from the backup copies of the files.