Incremental Backup Metadata for Early Ransomware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing incremental or differential backup systems lack effective methods for early detection of ransomware attacks, leading to prolonged latency in identifying infected systems and potential widespread contamination.
Innovation Solution
A method for detecting ransomware attacks by analyzing incremental or differential backup metadata to identify patterns indicative of encryption, such as pairs of new and deleted files, without requiring file content analysis, allowing for early warning and remedial actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If file content analysis is used to detect ransomware, then detection accuracy is improved, but processing time and computational resources increase
Solution Approach 1:
The patent extracts and analyzes only the metadata portion of backup files rather than examining complete file contents. This extraction approach focuses computational effort on the most informative elements (file names, paths, timestamps, sizes) while leaving out redundant data, thereby achieving effective ransomware detection with reduced processing time and resources
Solution Approach 2:
The patent segments the backup file into metadata and content portions, analyzing only the metadata segment for ransomware detection. This segmentation allows the system to process a smaller, more relevant subset of data that contains sufficient indicators of encryption patterns without the overhead of analyzing entire file contents
2Reliability
If complete backup files are analyzed for ransomware detection, then detection reliability is improved, but device complexity and processing overhead increase
Solution Approach 1:
The system extracts only the metadata component from backup files for analysis. This extraction eliminates the complexity of handling large binary file contents while retaining the essential information needed to detect ransomware patterns through metadata analysis alone
Solution Approach 2:
The patent employs lightweight metadata structures that are computationally inexpensive to process compared to complete backup files. These simplified data representations enable rapid analysis with minimal computational resources while maintaining detection effectiveness
3Measurement precision
If ransomware detection is performed after backup completion, then false positives are reduced, but latency in detecting infected systems increases
Solution Approach 1:
The patent performs ransomware detection during the backup process itself rather than after completion. By integrating detection into the backup workflow and analyzing metadata as it is being processed, the system achieves early detection of infected systems without waiting for backup completion, thereby reducing detection latency while maintaining accuracy
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Ransomware attack (RWA) detection is performed during an incremental or differential backup of a system of folders or directories of a computer or network of computers via an electronic network. The RWA detection includes processing incremental or differential backup metadata acquired during the incremental or differential backup to determine whether a RWA alert is issued. RWA remediation is performed at least in part on the RWA alert being issued. The RWA alert may be issued based on processing of the incremental or differential backup metadata to identify candidate new files and candidate deleted files in which the candidate new files are candidates for being encrypted copies of the candidate deleted files. RWA alert criterion may be based on counts of new versus deleted files in a folder or directory, and comparison of file sizes of the new versus deleted files.