File Trustworthiness Scoring for Cloud Ransomware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cybersecurity threats such as ransomware evade modern security tools by delivering files within a computing environment, leading to problematic files being stored or accessed without proper characterization of their trustworthiness.
Innovation Solution
A file analysis and scoring system utilizing an analysis engine and judgment engine with machine learning models to generate and determine trustworthiness scores for files, allowing for automated and on-demand processing to identify malicious content and initiate remediation actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple judges (machine learning models) are used to analyze files, then the accuracy and reliability of trustworthiness scoring is improved, but the system complexity and processing time increase
Solution Approach 1:
The system divides the file analysis task into multiple independent judges (machine learning models), each responsible for evaluating specific aspects of file trustworthiness. This segmentation allows parallel processing of files by different judges, improving reliability through multiple perspectives while managing complexity through modular architecture where each judge can be independently trained and optimized.
Solution Approach 2:
Multiple judges (machine learning models) are combined to collectively determine file trustworthiness scores. The system merges the outputs of multiple independent models to create a comprehensive assessment, leveraging the strengths of each model to achieve higher accuracy in identifying malicious files while distributing the computational load across multiple models.
2Speed
If files are analyzed in real-time upon upload, then the speed of threat detection is improved, but the processing time and computational resources increase
Solution Approach 1:
The system performs preliminary analysis of files immediately upon upload by triggering multiple judges to evaluate the files before they are fully processed or accessed. This preliminary action enables rapid threat detection and classification, allowing the system to quickly identify malicious files and take corrective actions while the files are still in an early state, reducing overall processing time for safe files.
Solution Approach 2:
The system dynamically adjusts the analysis process based on file characteristics and priority. Not all files require the same level of analysis, so the system can dynamically select which judges to apply based on file type, size, and potential risk, optimizing the balance between detection speed and processing resources consumed.
3Measurement precision
If comprehensive file attributes are collected and analyzed, then the precision of file characterization is improved, but the amount of data processing and storage requirements increase
Solution Approach 1:
The system extracts and collects only the most relevant and indicative file attributes for trustworthiness assessment, such as file type, size, creation date, digital signatures, and behavioral characteristics. By selectively extracting key attributes rather than collecting all possible data, the system achieves precise file characterization while minimizing data volume and processing requirements.
Solution Approach 2:
Different levels of attribute collection are applied to different file types and risk categories. The system applies local quality by tailoring the depth and type of attribute analysis to the specific characteristics of each file, collecting comprehensive attributes only for high-risk files that require detailed examination, while using lighter analysis for low-risk files.
Data Source
AI summary
A notification message is received indicating an upload of a file to a cloud service. An analysis engine (which can execute one or more machine learning models or other analysis operations) can generate information that characterizes the file which can be indicative of a level of trustworthiness for the file. In response to the generated information, each of a plurality of judges are notified to commence or revisit a judging process. In response to the notifications, the judges (which can execute one or more machine learning models or other analysis operations) retrieve the generated information and determine a respective trustworthiness score for the file. These scores can be stored in a corresponding judge database and/or data can be provided which characterizes the determined trustworthiness scores to a consuming application or process. Related apparatus, systems, techniques and articles are also described.