Intermittent Encryption Detection From Storage I/O Patterns
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ransomware attacks that employ intermittent encryption methods are difficult to detect, leading to incomplete data recovery as existing protection systems fail to identify these attacks, resulting in inaccessible partially encrypted data objects.
Innovation Solution
An intermittent encryption attack detector monitors input/output operations with a storage system to identify subsets of operations involving encrypted data segments, computes a confidence measure based on these operations, and compares it to thresholds to detect and respond to intermittent encryption attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If ransomware protection systems monitor encryption operations to detect attacks, then detection capability improves, but intermittent encryption attacks remain undetected because they encrypt only selected portions of data objects
Solution Approach 1:
The patent divides the monitoring task into segments by analyzing I/O operations at the data object level. Instead of monitoring entire data objects, the system segments monitoring to focus on individual I/O operations that access portions of data objects, identifying patterns where only some segments are encrypted while others remain accessible.
Solution Approach 2:
The patent applies partial action by monitoring only the necessary I/O operations rather than all operations. It identifies and focuses on I/O operations that access encrypted portions of data objects, computing confidence measures only for suspicious patterns rather than analyzing every single operation, thus detecting intermittent encryption without excessive overhead.
2Measurement precision
If the system monitors all I/O operations to detect encryption patterns, then detection accuracy improves, but system performance and processing speed deteriorate
Solution Approach 1:
The patent extracts and isolates only the critical I/O operations that are relevant to detecting intermittent encryption attacks. By taking out and focusing on suspicious I/O operations that access encrypted data portions, the system avoids processing all I/O operations, thereby maintaining detection accuracy while improving processing speed and reducing system overhead.
Solution Approach 2:
The system performs partial monitoring by computing confidence measures only for I/O operations that exhibit suspicious patterns. Rather than analyzing every I/O operation with full computational intensity, it applies monitoring selectively to operations that match encryption patterns, balancing detection accuracy with processing efficiency.
3Reliability
If ransomware encrypts entire data objects, then detection is easier, but data loss and inaccessibility increase; if intermittent encryption is used, then data recovery potential improves, but detection becomes more difficult
Solution Approach 1:
The patent segments the detection approach to work at the I/O operation level rather than the entire data object level. By dividing the monitoring task into individual I/O operations, the system can detect intermittent encryption patterns where only portions of data objects are encrypted, enabling both detection of the attack and preservation of recovery potential for unencrypted segments.
Solution Approach 2:
The patent uses confidence measures as a form of 'color coding' to mark suspicious I/O operations. By computing confidence scores that indicate the likelihood of encryption activity, the system highlights suspicious operations for further analysis, making intermittent encryption patterns visible and detectable without requiring full encryption of data objects.
Data Source
AI summary
In some examples, a system identifies, from among a plurality of input/output (I/O) operations with a storage system, a subset of I/O operations involving encrypted data segments of a given data size. The system computes a measure based on a quantity of the I/O operations in the subset of I/O operations involving the encrypted data segments of the given data size. Based on the measure, the system determines whether an intermittent encryption attack is occurring with respect to the storage system.