Ransomware Detection via Inode Journal Metadata Tagging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ransomware encryption of data makes it unusable, making it difficult for data owners to detect and stop the encryption process, as existing methods lack effective mechanisms to identify and counteract such threats in real-time.
Innovation Solution
Generating and evaluating metadata for processes interacting with data, using an inode journal to tag files with information about the last process that interacted with them, allowing for identification of suspected ransomware processes through error detection and subsequent security analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ransomware encrypts data, then data security is improved, but data usability deteriorates
Solution Approach 1:
The system performs preliminary actions by capturing metadata about processes interacting with data before encryption occurs. The inode journal records information about the last process that successfully accessed each file, allowing the system to detect encryption attempts by analyzing process behavior patterns and error conditions before the encrypted data becomes permanently unusable.
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring process interactions with data and using this information to detect ransomware activity. When errors are detected during data access, the system queries the inode journal for metadata about the last interacting process and provides feedback about suspected ransomware processes, enabling real-time detection and response.
2Difficulty of detecting and measuring
If metadata tagging is implemented to track process interactions, then detection capability is improved, but system complexity increases
Solution Approach 1:
The system uses an intermediary approach by introducing an inode journal as a mediator between the filesystem and the detection system. This journal captures metadata about process interactions in a centralized structure, simplifying the complexity of tracking which processes accessed which files. The journal acts as an intermediary data store that enables detection without requiring complex real-time monitoring of all process interactions.
3Loss of time
If real-time monitoring of process interactions is performed, then response time is improved, but computational resources increase
Solution Approach 1:
The system extracts only the necessary information for detection by capturing metadata about process interactions rather than monitoring all process details. The inode journal stores specific information about the last process that successfully accessed each file, allowing the system to detect ransomware by querying this extracted metadata when errors occur, rather than continuously analyzing all process behavior in detail.
Data Source
AI summary
One method includes tagging data with metadata that identifies a last process that interacted with the data, detecting an error that occurs when another process attempts to interact with the data that has been tagged with the metadata, in response to detecting the error, performing a query to identify the last process, and taking an action with respect to the last process. The query includes examining the metadata to identify the last process.