Filesystem Ransomware Detection via Snapshot Entropy Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods fail to detect ransomware infections early enough to prevent data loss and propagation, as they often require a ransom demand to be made or significant time to propagate throughout a filesystem, allowing uninfected backup versions to age out.
Innovation Solution
The system analyzes image-based snapshots of a filesystem to identify ransomware target file types and active user directories, calculating entropy values and comparing file counts to detect potential infections before they spread, allowing for timely mitigation actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the system waits for ransom demand or significant propagation to detect infection, then detection reliability is improved, but detection time is excessively delayed allowing data loss
Solution Approach 1:
The system performs preliminary analysis of backup images to detect ransomware infections before they propagate or before ransom demands are made. By examining file entropy and comparing against known ransomware patterns in advance, the system enables early detection and mitigation actions, preventing data loss while maintaining reliable detection through pre-established detection criteria
2Measurement precision
If the system analyzes every backup image thoroughly, then detection precision is improved, but processing time and computational resources increase
Solution Approach 1:
The system applies partial analysis by focusing computational resources on specific indicators such as file entropy calculations and comparing only critical file characteristics against ransomware patterns. This selective approach maintains high detection precision by examining the most telling features while avoiding exhaustive analysis of every file attribute, thus reducing processing time without sacrificing detection accuracy
3Reliability
If backup retention period is extended to maintain infection evidence, then detection capability is improved, but storage requirements increase
Solution Approach 1:
The system extracts only the essential detection evidence from backup images rather than retaining complete backup copies. By extracting key indicators such as file entropy values, file type distributions, and ransomware pattern matches, the system maintains detection capability while significantly reducing the storage requirements compared to keeping all backup images indefinitely
Data Source
AI summary
The present disclosure is directed at systems and methods for detecting ransomware infection in filesystems. These systems and methods may enable a computer user to detect a ransomware infection within a filesystem utilizing a snapshot image-based backup. According to some embodiments, the disclosed systems and methods analyze metadata describing the contents of an examined filesystem embodied in a Master File Table (MFT). Also according to some embodiments, the disclosed systems and methods compute an entropy associated with an extracted sample of files to distinguish between infected and uninfected file systems. Relative to other techniques, the disclosed systems/methods can decrease the time and/or computational resources required to detect ransomware, while also decreasing false positives and false negatives.