Multiprocess Clustering for Kernel-Level Ransomware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing endpoint anti-malicious code software running at the application layer cannot detect the latest ransomware until a vaccine is updated, and setting access rights for all processes is inconvenient and prone to false positives.
Innovation Solution
A multiprocess clustering-based ransomware attack detection device operates at the kernel level, clustering processes and information accessed by them, allowing quick detection and blocking of ransomware by monitoring changes and damage on a per-cluster basis without requiring vaccine updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If endpoint anti-malicious code software runs at the application layer to detect ransomware, then it can operate with user-level access, but it cannot detect the latest ransomware until a vaccine is updated
Solution Approach 1:
The patent transitions the detection mechanism from the application layer to the kernel layer of the operating system. This dimensional change in the system architecture enables direct monitoring of process creation and information access at the core level, allowing immediate detection of ransomware behavior without waiting for application-layer vaccine updates.
Solution Approach 2:
The system pre-establishes monitoring of process creation and information access patterns at the kernel level before ransomware infection occurs. By having detection mechanisms in place at the fundamental system level, the system can immediately identify and respond to ransomware activities as they begin, eliminating detection delays associated with post-infection vaccine deployment.
2Reliability
If access rights are set for all processes to detect ransomware, then detection coverage is improved, but it takes a lot of time to check access rights and processes without set rights may be mistaken for ransomware
Solution Approach 1:
The patent extracts the essential detection target from the set of all processes by focusing specifically on processes created from a parent process at the kernel level. This extraction allows the system to monitor only the relevant subset of processes that exhibit ransomware-like behavior patterns, eliminating the need to check access rights for every process and reducing false positives.
Solution Approach 2:
The system applies different monitoring strategies to different process groups. Instead of uniformly setting access rights for all processes, the patent implements targeted monitoring for processes created from specific parent processes at the kernel level, applying detection resources locally where ransomware behavior is most likely to occur.
3Measurement precision
If processes are monitored individually for ransomware detection, then detailed monitoring is possible, but it is inconvenient and prone to false positives
Solution Approach 1:
The patent merges multiple individual process monitoring tasks into a unified cluster-based monitoring system. Processes created from the same parent process at the kernel level are grouped into clusters, and monitoring is performed at the cluster level. This merging maintains detailed monitoring capability while significantly improving operational convenience by reducing the number of independent monitoring operations required.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present disclosure relates to a ransomware attack detection device and method, and a recording medium having a program recorded thereon, the program for implementing the method. More particularly, the present disclosure relates to a multiprocess clustering-based ransomware attack detection device and method, and a recording medium having a program recorded thereon, the program being configured to implement the method, wherein a cluster ID for a cluster assigned to processes created at a kernel level of an operating system (OS) is created, processes branched from one parent process and information read and written by the processes are clustered for each cluster ID, and a ransomware attack is detected and blocked according to whether the clustered information is changed or damaged.