Malware Detection Agent Using Entropy and Divergence Features
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies struggle to effectively distinguish between normal data overwriting and malware-associated encrypted overwriting, particularly in cases where weaker forms of encryption are used, making it difficult to detect ransomware attacks and mitigate data loss.
Innovation Solution
The implementation of a malware detection agent that analyzes data overwrites by computing features based on the original and new data components, using Shannon entropies and Kullback-Leibler divergences to detect encrypted data, and employing a linear Support Vector Machine for classification to identify potential malware attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional data overwrite detection methods are used, then normal data operations are not interfered with, but malware attacks such as ransomware cannot be detected
Solution Approach 1:
The system performs preliminary actions by capturing snapshots of data before overwrite operations occur. These snapshots serve as reference points that allow the system to detect subsequent overwrites and determine whether they are normal or malicious, enabling early detection of ransomware attacks before significant data loss occurs.
Solution Approach 2:
The system introduces an intermediary mechanism using checksums and metadata to compare original data with overwritten data. This intermediary layer allows the system to detect changes without directly analyzing the actual data content, reducing computational complexity while maintaining detection accuracy.
2Reliability
If data snapshots are maintained to detect overwrites, then data loss can be mitigated, but storage space is consumed and snapshot management becomes complex
Solution Approach 1:
The system extracts only the essential information needed for detection - checksums, metadata, and overwrite detection signals - rather than storing complete data snapshots. This extraction approach significantly reduces storage requirements while maintaining the ability to detect and respond to malicious overwrites.
Solution Approach 2:
By capturing data snapshots at critical points in time before overwrites occur, the system creates reference information that can be quickly compared against subsequent changes. This preliminary capture allows for rapid detection without requiring continuous storage of all data states.
3Measurement precision
If encryption detection algorithms are applied to all data overwrites, then malware detection accuracy improves, but processing time increases
Solution Approach 1:
The system applies different detection strategies to different data types and contexts. Instead of uniformly applying complex encryption detection algorithms to all overwrites, the system prioritizes analysis based on data sensitivity, file type, and risk indicators, applying full analysis only where necessary to balance accuracy with processing speed.
Solution Approach 2:
The system performs partial analysis by first checking for obvious indicators of malware (such as known ransomware signatures or suspicious metadata patterns) before applying more comprehensive encryption detection algorithms. This staged approach reduces processing time for low-risk cases while maintaining high detection accuracy for malicious overwrites.
Data Source
AI summary
A method, a computing device, and a non-transitory machine-readable medium for detecting malware attacks. In one example, an agent implemented in an operating system detects an overwrite in which an original data component is overwritten with a new data component. The agent computes a plurality of features associated with the overwrite, the plurality of features including an original entropy corresponding to the original data component, a new entropy corresponding to the new data component, an overwrite fraction, and a set of divergence features. The agent determines whether the new data component is encrypted using the plurality of features.