Network Share Ransomware Blocking With Pre-Write Data Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity methods are inadequate in preventing the spread of ransomware across network shares, especially when only one endpoint is infected, due to lack of segmentation and access controls, and current detection methods fail to detect encryption at an early stage.
Innovation Solution
A method that buffers data into memory before writing to disk and verifies it using an antivirus engine, blocking encryption if detected, thereby preventing the spread of ransomware across a network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If write protection is used to prevent ransomware encryption, then data security is improved, but the ability to change data is lost
Solution Approach 1:
The system performs preliminary action by scanning data before it is written to the network drive. The antivirus engine analyzes the data in memory prior to write operations, allowing the system to prevent ransomware encryption while maintaining normal data modification capabilities for legitimate applications.
Solution Approach 2:
The system introduces an intermediary layer between the application and the network drive. The antivirus engine acts as a mediator that intercepts write operations, scans the data, and controls whether the write operation is allowed to proceed, thus preventing ransomware while preserving legitimate data changes.
2Measurement precision
If signature-based detection is used to identify ransomware, then detection accuracy is improved, but false detection of valid programs occurs
Solution Approach 1:
The system performs preliminary scanning of data before it is written to the network drive. This allows the antivirus engine to analyze data patterns and behavior in context, reducing false positives by understanding the intended purpose of the data modification operation before blocking it.
Solution Approach 2:
The system implements feedback mechanisms where the antivirus engine continuously monitors and learns from scanning results. This feedback loop allows the system to refine its detection algorithms, reducing false detections of valid programs while maintaining high accuracy in identifying ransomware.
3Speed
If real-time protection scanning is implemented, then ransomware detection speed is improved, but system performance degradation occurs
Solution Approach 1:
The system performs preliminary scanning actions before data is written to the network drive, allowing rapid detection of ransomware patterns in memory. This preliminary action approach enables fast detection without requiring continuous scanning of all disk operations, thus reducing performance impact.
Solution Approach 2:
The system applies local quality by focusing scanning resources on specific critical areas - data being written to network drives - rather than uniformly scanning all system operations. This targeted approach maintains high detection speed for ransomware while minimizing overall system performance degradation.
Data Source
AI summary
There is provided a system and method for eliminating ransomware infections on network shares. The system and method determines if a file on a shared network drive is written to, then the system buffers the data into memory and does not allow writing to the disk. After buffering, it sends this data for verification in user mode through a system service to an antivirus engine crypto-locker scanner. The anti-virus engine makes a verdict and if it does not detect encryption, then the data is recorded. If encryption was detected, the recording is blocked and localized to prevent spreading across a network.