Graph Convolutional Network for Ransomware Target Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current ransomware detection methods are computationally expensive and time-consuming, and struggle to generalize to unknown ransomware variants, often relying on data protection as the last line of defense.
Innovation Solution
A computer-implemented method and system that uses machine learning models, specifically Graph Convolutional Networks (GCNs), to identify vulnerable targets by learning file and path patterns, and graphical patterns susceptible to ransomware attacks, allowing for focused detection of previously unknown ransomware threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current ransomware detection scanning spans over the entire backup snapshot, then detection coverage is improved, but computational cost and time consumption increase
Solution Approach 1:
The patent segments the backup snapshot into multiple sub-snapshots based on temporal relationships and vulnerability assessments. Instead of scanning the entire snapshot uniformly, the system divides it into manageable segments that can be processed independently, allowing parallel processing and reducing overall detection time while maintaining comprehensive coverage through systematic segment examination.
Solution Approach 2:
The patent applies local quality by assigning different scanning depths and methods to different segments of the backup snapshot based on their vulnerability profiles. High-risk segments undergo thorough scanning while low-risk segments receive lighter inspection, optimizing resource allocation and reducing unnecessary computational overhead on safe portions of the backup data.
2Measurement precision
If current ransomware detection adapts to existing ransomware behavior, then detection accuracy for known threats is improved, but generalization to unknown ransomware deteriorates
Solution Approach 1:
The patent performs preliminary vulnerability assessment and file pattern analysis before actual ransomware detection. By pre-identifying vulnerable files, directories, and structural patterns in the backup snapshot, the system prepares feature representations that capture both known and unknown ransomware targets. This preliminary action enables the detection model to generalize better to unseen ransomware variants while maintaining accuracy on known threats.
Solution Approach 2:
The patent transforms the detection approach by changing parameters from behavior-based signatures to structural and vulnerability-based features. Instead of relying on known ransomware behavior patterns, the system analyzes file system structure, vulnerability metrics, and contextual relationships that remain consistent across different ransomware variants, enabling both accurate detection of known threats and effective generalization to unknown ones.
3Reliability
If comprehensive backup protection is implemented, then data security is improved, but resource consumption increases
Solution Approach 1:
The patent implements partial action by focusing protection efforts on the most vulnerable portions of the backup snapshot rather than applying uniform comprehensive scanning to all data. The system identifies and prioritizes high-risk segments based on vulnerability assessments, applying intensive protection measures only where necessary while using lighter monitoring for lower-risk areas, thus reducing overall resource consumption while maintaining adequate security.
Data Source
AI summary
A processor can be configured to receive data associated with, and/or access to, a computing system's file system structure. The processor can also be configured to determine file patterns, file path patterns and/or graph patterns associated with the computing system. The processor can also be configured to build a graph structure having nodes and edges, the graph structure representing the file patterns, file path patterns and graph patterns, wherein the nodes of the graph structure represent files and attributes of the files and the edges of the graph structure represent connectivity between the files. The processor can also be configured to train, based on the graph structure, a first machine learning model to learn a feature vector associated with a file. The processor can also be configured to train, based on the feature vector, a second machine learning model to identify a vulnerable ransomware target.