Hybrid Data Scan Pipeline for Low-Latency Ransomware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems face challenges in detecting ransomware attacks efficiently, often leading to late detection or substantial latency due to computational bottlenecks, which can complicate data recovery.
Innovation Solution
A hybrid data scan pipeline that utilizes a frontend and backend approach, where a first segment of incoming data is scanned for entropy changes simultaneously with reception, and the remaining segments are scanned at the backend, ensuring minimal latency and high accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If data scanning is performed at the backend bottleneck, then scanning accuracy is improved, but response latency increases substantially
Solution Approach 1:
The patent segments the data scanning process into two distinct phases: a fast initial scan that provides preliminary detection results quickly, and a subsequent detailed scan that performs comprehensive analysis. This segmentation allows the system to deliver early warnings through the initial scan while maintaining high accuracy through the detailed scan, thereby resolving the contradiction between response latency and scanning accuracy.
2Reliability
If privacy preservation operations are instrumented in the computational storage backend, then data compliance is ensured, but detection timeliness deteriorates
Solution Approach 1:
The patent implements a preliminary scanning operation that performs initial attack detection before the main data processing pipeline completes. This preliminary action enables early detection of ransomware attacks, providing timely warnings while the more comprehensive privacy preservation and compliance operations continue in the backend, thus resolving the contradiction between data compliance and detection timeliness.
Data Source
AI summary
Methods, systems, and computer program products provide a hybrid data scan pipeline or detector that reduces (as compared to conventional storage operations) response latency and increases scanning accuracy of encryption attacks such as ransomware attacks. For example, a frontend of a storage platform receiving an incoming data object may scan a portion of the data object for a change of an entropy level. The portion scanned may be insignificant relative to the overall size of the data object. As such, the operations of the frontend would place an insignificant delay to the overall storage processing. Other portions of the data object will be processed at a backend of the storage platform. For example, subsequent to receiving the data object, a change of entropy level of the other portions is scanned for detecting ransomware attacks.