Filesystem Ransomware Detection Using Backup-Based Two-Stage Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing ransomware detection methods, such as signature-based and behavioral analysis, are ineffective against evolving ransomware threats and resource-intensive, especially in large organizations with diverse filesystems.
Innovation Solution
A system that analyzes filesystem behavior and content using backup data, employing machine learning models trained through unsupervised methods to detect ransomware infection by calculating an infection score based on abnormal behavior and encryption probability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If signature-based ransomware detection is used, then detection simplicity is maintained, but detection effectiveness deteriorates because ransomware can avoid detection by using different signatures
Solution Approach 1:
The patent replaces signature-based mechanical detection with machine learning-based intelligent detection. The system uses ML models to analyze filesystem behavior patterns and predict ransomware infections, transitioning from rigid signature matching to adaptive pattern recognition that can detect novel ransomware variants.
Solution Approach 2:
The system continuously learns from filesystem behavior patterns and automatically updates its detection models without human intervention. The ML models self-improve by analyzing normal vs. abnormal behavior patterns, enabling the system to adapt to evolving ransomware tactics autonomously.
2Reliability
If behavioral analysis approach is used, then detection effectiveness is improved, but computational resource consumption increases
Solution Approach 1:
The patent segments the detection process into multiple stages: first analyzing filesystem behavior patterns using ML models to identify anomalies, then only deeply analyzing file content (entropy calculation) when behavioral anomalies are detected. This staged approach reduces overall computational resources while maintaining high detection effectiveness.
Solution Approach 2:
The system applies partial analysis by using lightweight behavioral pattern matching before resorting to heavier content analysis only when necessary. The ML models perform preliminary screening that filters out normal operations, preventing unnecessary computational resources from being spent on analyzing benign filesystem operations.
3Adaptability or versatility
If comprehensive ransomware detection is implemented in large organizations with multiple disparate filesystems, then detection coverage is improved, but system complexity and resource consumption increase
Solution Approach 1:
The patent implements a universal detection framework that works across multiple disparate filesystem types through a single machine learning model. The model is trained to recognize ransomware behavior patterns universally, making the system adaptable to different filesystem structures without requiring separate detection mechanisms for each filesystem type.
Solution Approach 2:
The system adapts to different filesystems by monitoring changes in behavioral parameters rather than relying on filesystem-specific signatures. The ML models analyze patterns in file operations, access times, and data transformations that are common across various filesystem types, allowing the same detection mechanism to function universally.
Data Source
AI summary
Described herein is a system that detects ransomware infection in filesystems. The system detects ransomware infection by using backup data of machines. The system detects ransomware infection in two stages. In the first stage, the system analyzes a filesystem's behavior. The filesystem's behavior can be obtained by loading the backup data and crawling the filesystem to create a filesystem metadata including information about file operations during a time interval. The filesystem determines a pattern of the file operations and compares the pattern to a normal patter to analyze the filesystem's behavior. If the filesystem's behavior is abnormal, the system proceeds to the second stage to analyze the content of the files to look for signs of encryption in the filesystem. The system combines the analysis of both stages to determine whether the filesystem is infected by ransomware.