IO Interceptor Malware Detection for Low-Latency Data Integrity Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods in computing systems are time-consuming and disruptive, often requiring significant access to disk data, which can lead to delayed detection and potential system damage before countermeasures are deployed.
Innovation Solution
A datacenter scale ransomware detection paradigm using an interceptor and detector system that intercepts Input/Output (IO) operations in the data path, allowing real-time or near-real-time analysis of metadata and data streams to detect malware, with the detector generating alerts and triggering responses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional disk scanning methods are used to detect malware, then detection thoroughness is improved, but detection time increases and system operations are disrupted
Solution Approach 1:
The system performs preliminary actions by continuously monitoring and analyzing IO operations in real-time as they occur, rather than waiting to scan disks periodically. The interceptor captures IO requests and responses, and the detector analyzes these operations continuously, so malware behavior is detected as it happens, eliminating the delay between infection and detection that plagues conventional scanning approaches
Solution Approach 2:
The invention extracts only the necessary information for detection by intercepting and analyzing specific IO operations and their metadata, rather than scanning entire disks. The interceptor selectively captures IO requests, responses, and metadata relevant to malware detection, and the detector focuses analysis on these extracted elements, dramatically reducing detection time while maintaining thoroughness
2Reliability
If disk scanning is performed to ensure malware detection, then detection reliability is improved, but normal disk operations are interfered with
Solution Approach 1:
The interceptor acts as an intermediary component that sits between the application and the disk, capturing IO operations without disrupting the normal data flow. It intercepts IO requests and responses, extracts relevant information for analysis, and allows normal operations to continue uninterrupted. This mediator approach enables reliable malware detection through continuous monitoring while maintaining seamless disk operations
Solution Approach 2:
The system segments the detection function from the disk operations by creating a separate detection pathway. The interceptor divides IO operations into analyzable components (requests, responses, metadata), and the detector processes these segmented elements independently. This segmentation allows reliable detection analysis to occur in parallel with normal disk operations, preventing interference
3Measurement precision
If comprehensive data analysis is performed to detect malware, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The system applies partial action by analyzing only the specific IO operations and metadata that are relevant to malware detection, rather than performing comprehensive analysis on all disk data. The detector focuses on examining IO requests, responses, and metadata patterns that indicate malicious behavior, ignoring irrelevant data. This selective partial analysis maintains high detection accuracy while dramatically improving processing speed
Data Source
AI summary
A detection engine for detecting threats to a computing system is disclosed. The detection engine includes an interceptor that is positioned in a data path and configured to intercept IOs. The interceptor transmits a data stream, which may include data and/or metadata or the intercepted IOs, to a detector. The detector perform a detection analysis. When a threat is detected, a response may be initiated. The interceptor is configured to perform the response.