Malware Detection via File System Event Stream Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting ransomware are often too late in the process and lack accuracy, typically relying on family classification or simple encryption detection, failing to prevent malicious file changes before they occur.
Innovation Solution
A statistical technique and data analytics approach that uses a source-agnostic model to analyze mathematical transformations of data, identifying patterns indicative of ransomware attacks before files are encrypted, employing ensemble models like random forest and partial least squares regression to predict malicious changes and revert or restore original file versions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If current detection methods (family classification, simple encryption detection) are used, then the detection process is simple and fast, but the detection accuracy is low and detection occurs too late in the process
Solution Approach 1:
The patent applies preliminary action by monitoring file system events and analyzing data transformations before the encryption process completes. The system tracks file access patterns, data modification events, and encryption operations in real-time, enabling detection and potential intervention before permanent damage occurs. This is achieved through event monitoring components that capture pre-encryption states and analyze transformation patterns during the encryption process.
Solution Approach 2:
The patent replaces traditional mechanical detection methods (signature-based family classification, simple encryption detection) with a data-driven analytical system. Instead of relying on predefined rules and patterns, the system uses statistical analysis of file system events, data transformation monitoring, and machine learning models to detect ransomware behavior. This substitution enables more accurate detection of novel ransomware variants while maintaining operational simplicity.
2Reliability
If traditional detection methods are used, then the system operates with low complexity, but the ability to prevent malicious file changes is insufficient
Solution Approach 1:
The patent implements feedback mechanisms by continuously monitoring file system events and using the observed data to update detection models in real-time. The system analyzes encryption patterns, file transformation events, and process behaviors, then feeds this information back to refine detection algorithms and improve prevention accuracy. This closed-loop approach enables the system to adapt to new ransomware variants and improve its prevention capability over time while maintaining manageable complexity through automated learning processes.
Solution Approach 2:
The system performs preliminary analysis of file system events and data transformations to identify suspicious patterns before malicious changes are completed. By monitoring encryption operations in progress and analyzing transformation patterns, the system can intervene early to prevent permanent damage, thereby improving reliability without requiring overly complex intervention mechanisms.
3Measurement precision
If early detection methods are implemented, then prevention accuracy improves, but the computational resources and processing time increase
Solution Approach 1:
The patent applies partial action by focusing computational resources on analyzing only the most critical file system events and data transformations related to potential encryption operations. Instead of monitoring all system activity equally, the system prioritizes analysis of file access patterns, modification events, and encryption-specific operations. This selective approach enables high early detection accuracy while minimizing unnecessary computational overhead and resource consumption.
Data Source
AI summary
A method for halting malware includes: monitoring plural file system events with a system driver to detect an occurrence of a file system event having a predetermined file type and log event type; triggering a listening engine for file system event stream data of a file associated with the detection of the file system event, the file system event stream data indicating data manipulation associated with the file due to execution of a process; obtaining one or more feature values for each of plural different feature combinations of plural features of the file based on the file system event stream data; inputting one or more feature values into a data analytics model to predict a target label value based on the one or more feature values of the plural different feature combinations and agnostic to the process; and performing a predetermined operation based on the target label value.