Malicious Software Detection via File Metadata Tree Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems lack effective methods to detect malicious software, such as ransomware, in enterprise computing systems, leading to data loss, time delays, and financial losses due to encryption of files, which existing technologies fail to address efficiently.
Innovation Solution
A system utilizing a tree data structure, like the Cohesity Snaptree, to organize file system metadata snapshots, allowing for the detection of malicious software by analyzing changes in file metadata trees, deduplication rates, and entropy, enabling the identification of potentially infected files through comparison with historical data and seasonal trends.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional malicious software detection methods are used, then detection capability is limited, but system resources are consumed and false positives increase
Solution Approach 1:
The system performs preliminary analysis by organizing file system metadata into tree structures and calculating baseline statistics (entropy, deduplication rates, file counts) before actual detection occurs. This preliminary organization enables efficient comparison during detection without consuming excessive resources at detection time.
Solution Approach 2:
The patent introduces an intermediary analysis layer that compares current file system statistics against historical baselines and seasonal trends. This intermediary layer filters out normal variations and focuses detection only on anomalous changes, reducing false positives and resource consumption.
2Measurement precision
If comprehensive file analysis is performed to detect malicious software, then detection accuracy improves, but restore actions are delayed
Solution Approach 1:
The system applies different analysis depths to different parts of the file system based on risk assessment. High-priority or frequently accessed files receive more thorough analysis, while low-priority files use lighter inspection. This localized quality approach maintains detection accuracy for critical files while reducing overall analysis time.
Solution Approach 2:
The patent implements a multi-stage detection process where initial screening uses partial analysis (comparing key statistics like entropy and file counts), and only suspicious files undergo excessive/detailed analysis. This partial action approach enables rapid detection of most threats while reserving comprehensive analysis for borderline cases.
3Reliability
If multiple statistics are used to assess file changes, then false positives are reduced, but analysis complexity increases
Solution Approach 1:
The detection system segments the analysis into distinct statistical categories: entropy metrics, deduplication rates, file count changes, and size variations. Each segment is calculated and compared independently against historical baselines. This segmentation allows the system to use multiple statistics without overwhelming complexity, as each segment can be processed and evaluated separately.
Data Source
AI summary
An amount of data change associated with a version of a content file with respect to one or more previous versions of the content file is determined. The amount of change associated with the version of the content file is determined using a tree data structure associated with the content file that is stored on a storage cluster. One or more statistics associated with backup snapshot are provided to a server. The server is configured to determine that the amount of data change associated with the version of the content file is anomalous based in part on the one or more statistics associated with the backup snapshot. A notification that data associated with the backup snapshot is potentially infected by malicious software is received from the server. The version of the content file is indicated as being potentially infected by malicious software.