Machine Learning Filename Extension Analysis for Ransomware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing ransomware detection methods rely on outdated malware extension catalogs, leading to performance slowdowns and false positives, and are ineffective against new malware strains.
Innovation Solution
Anomaly detection analysis of filename extension patterns using machine learning, which compares filename extension counts between backup jobs to identify anomalies, regardless of specific extensions, without real-time monitoring or reliance on malware catalogs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If real-time monitoring of file system is implemented to detect ransomware, then detection speed is improved, but system performance is slowed down
Solution Approach 1:
The patent implements periodic analysis of filename extension patterns at backup job boundaries rather than continuous real-time monitoring. The system counts distinct filename extensions during each backup job and compares these counts to historical patterns, achieving timely detection without the performance overhead of constant monitoring.
2Reliability
If malware extension catalogs are maintained and updated frequently to detect new malware strains, then detection accuracy is improved, but maintenance complexity increases
Solution Approach 1:
The system performs self-service by automatically learning normal filename extension patterns from historical backup data and comparing current patterns against these learned patterns. This eliminates the need for manual catalog maintenance, as the system adapts automatically to legitimate changes in filename extensions while detecting anomalies that indicate ransomware.
3Measurement precision
If filename extension comparisons are performed against known malware catalogs, then detection precision is improved for known malware, but false positives increase for new applications
Solution Approach 1:
Instead of checking if filename extensions match known malware patterns (positive identification), the system inverts the approach by checking if filename extension patterns deviate from normal behavior (anomaly detection). This inversion reduces false positives because it only flags genuine anomalies rather than misidentifying legitimate new applications as malware.
Data Source
AI summary
Ransomware detection accuracy is improved by analyzing patterns of changes in filename extension counts, relative to each other, that occur in a file system over time. The disclosed approach is malware-agnostic and does not rely on recognizing malware extensions or on real-time monitoring of the target file system. Instead, during each successive backup job of the target file system, the disclosed technology counts different types of filename extensions and compares the counts to each other and to corresponding counts taken in earlier backup jobs. Preferably, the anomaly detection analysis uses machine learning to discern a behavior pattern of the file system, which indicates how filename extensions are distributed and how much they change between backup jobs over time.