Kernel-Level Ransomware Detection via File Header Statistical Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing ransomware detection methods are incomplete or lead to heavy processing, which can be easily detected by ransomware viruses, and do not effectively address the rapid encryption of files by these viruses.
Innovation Solution
A sentinel program operating at the kernel level that analyzes write requests to files by comparing them to a statistical model of ordinary writing patterns, issuing alerts and taking actions such as neutralizing or monitoring threads based on deviations from these patterns, and using a chi-square calculation to assess randomness and detect potential ransomware activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing antivirus methods systematically analyze all write requests, then detection completeness is improved, but processing overhead increases and can be easily detected by ransomware
Solution Approach 1:
The patent segments the detection process into two levels: a lightweight statistical model that analyzes only file headers (first segmentation) and a more comprehensive analysis reserved for suspicious cases. This hierarchical segmentation allows the system to maintain low processing overhead for normal operations while achieving high detection completeness when needed, resolving the contradiction between reliability and device complexity.
2Measurement precision
If ransomware detection analyzes random character strings in file content, then detection accuracy is improved, but computational cost increases significantly
Solution Approach 1:
The patent extracts only the essential detection feature (random character patterns) from the file content, specifically analyzing the header portion rather than the entire file. By taking out just the critical segment that contains ransomware indicators, the system achieves good detection accuracy while minimizing computational cost, thus resolving the contradiction between measurement precision and energy consumption.
3Reliability
If sentinel program monitors all file write operations, then ransomware detection capability is improved, but system performance degradation occurs
Solution Approach 1:
The patent applies partial action by monitoring only the file header portion (a small subset of the entire file) rather than all file operations in detail. This partial monitoring approach maintains strong ransomware detection capability while minimizing the impact on system performance, effectively resolving the contradiction between reliability and productivity.
Data Source
Figure 1~3
Figure 2
Figure 4~5
AI summary
Method and device for detecting encryption, in particular for anti-ransomeware software. The invention relates to a device for detecting encryption, comprising a computer (1) with a central processing unit (4) and a memory, which comprises a random-access memory (9) and a mass memory unit (6) comprising files. The central processing unit (4) cooperates with the random-access memory (9) and with an operating system (10) which comprises a core (12) and which is capable of having processes (18) carried out by the central processing unit (4); said processes (18) are divided into wires (20) and may comprise functions for accessing the files. A statistical model for ordinary writing to the header of a file is stored in the memory (6, 9). The device comprises a monitoring program (32) which is active in the core (12) and which is provided to: - recover (30) the write requests (24) in a file (8), said write requests (24) being transmitted by each wire (20), such requests (24) comprising, as an argument, a string of characters to be written, - calculate a first deviation value as a function of the portion of the string of characters relating to the header of the file and the statistical model for writing to the header, then - deliver a first warning if the first deviation value exceeds a first threshold.