Modified Data Fragment Accumulation for Intermittent Encryption Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing ransomware protection systems fail to detect intermittent encryption attacks, where ransomware encrypts selected portions of data objects, leading to data loss and inability to recover original data.
Innovation Solution
An intermittent encryption attack detector accumulates modified data fragments into a buffer larger than a size threshold and applies entropy-based and statistical tests to detect encryption, using an accumulator buffer and encryption detection techniques like Shannon entropy, Chi-Square test, and CUMSUM test.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ransomware encrypts selected portions of data objects (intermittent encryption), then the attack evades detection by existing protection systems, but this leads to data loss and inability to recover original data
Solution Approach 1:
The system segments the data object into fragments and processes each fragment individually, comparing modified fragments against the original data to identify encryption patterns. This segmentation allows detection of intermittent encryption where only selected portions are encrypted, rather than requiring complete data encryption for detection.
Solution Approach 2:
The system performs preliminary actions by accumulating modified data fragments into a buffer before final detection. It continuously monitors data changes and stores modified fragments in an accumulator buffer, which is then analyzed using entropy-based and statistical tests to detect encryption attacks in advance, enabling timely intervention before complete data loss occurs.
2Difficulty of detecting and measuring
If existing protection systems monitor entire data objects, then they can detect complete encryption attacks, but they fail to detect intermittent encryption where only selected portions are encrypted
Solution Approach 1:
The system divides the data object into smaller fragments and monitors each fragment independently. By comparing modified fragments against the original data and accumulating them in a buffer, the system can detect encryption patterns in selected portions without requiring monitoring of entire data objects, thereby improving detection capability for intermittent encryption attacks.
Solution Approach 2:
The system introduces an intermediary accumulator buffer that collects and stores modified data fragments before final analysis. This intermediary structure allows the system to aggregate evidence from multiple fragments and apply statistical tests (entropy-based and CUMSUM) to determine whether the accumulated modifications indicate an encryption attack, improving detection accuracy.
3Measurement precision
If the system accumulates modified data fragments into a buffer larger than a size threshold, then encryption attacks can be detected with higher accuracy, but this increases processing time and computational resources
Solution Approach 1:
The system dynamically adjusts the buffer size threshold and processing intensity based on the accumulation rate of modified fragments. When the buffer reaches the size threshold, the system performs detection using entropy-based and statistical tests. This dynamic approach allows the system to maintain high detection precision while minimizing processing time by only performing comprehensive analysis when sufficient data is accumulated.
Solution Approach 2:
The system continuously monitors and accumulates modified data fragments in the buffer, maintaining constant surveillance without requiring periodic comprehensive analysis. This continuous accumulation approach allows the system to prepare data for detection in advance, reducing processing time when actual detection is needed while maintaining high precision through continuous data gathering.
Data Source
AI summary
In some examples, a system identifies data fragments of a data object that are modified relative to a different version of the data object. The system accumulates the data fragments into a buffer, and computes a measure based on data in the buffer, the data comprising the data fragments. The system determines, based on the measure, whether the data object is a subject of an intermittent encryption attack.