Object Storage Entropy Scanning for Ransomware Encryption Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems in storage platforms are vulnerable to new malware variants and fail to protect shared storage environments, as they rely on signature-based detection that is difficult to maintain and are compromised by a single vulnerable client.
Innovation Solution
Implementing entropy analysis to detect involuntary encryption in storage systems by monitoring data objects for changes in entropy levels, tracking encryption rates across object repositories, and performing remediation to preserve data integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection is used for malware detection, then existing malware can be detected, but the system becomes vulnerable to new malware variants and requires continuous signature updates
Solution Approach 1:
The patent changes the detection parameter from static malware signatures to dynamic entropy values. Instead of matching fixed patterns, the system calculates entropy—a statistical measure of randomness—for data objects and compares changes in entropy over time. This parameter transformation enables detection of new malware variants without requiring signature updates, as entropy-based detection adapts to any data pattern changes.
2Reliability
If signature-based detection is used, then known malware can be identified, but the system fails to protect shared storage environments where a single vulnerable client can compromise the entire storage
Solution Approach 1:
The patent segments the storage system into independent data objects, each with its own entropy tracking. Instead of treating the entire storage environment as a single unit that can be compromised, the system monitors individual data objects for entropy changes. This segmentation isolates the impact of malware to specific objects rather than allowing propagation across the entire shared storage environment.
Solution Approach 2:
The system implements continuous feedback by monitoring entropy changes of data objects over time. When entropy changes exceed a threshold, the system triggers alerts and remediation actions. This feedback mechanism enables real-time detection and response to malware activity, preventing the spread of infection across shared storage environments.
3Reliability
If traditional malware detection methods are used, then existing malware can be detected, but the system cannot detect involuntary encryption events in real-time
Solution Approach 1:
The patent performs preliminary action by continuously monitoring and storing entropy values of data objects before encryption occurs. When data is written to storage, the system calculates and saves the entropy value. Subsequent changes in entropy are then easily detected by comparing against these baseline values, enabling real-time detection of encryption events without requiring complex analysis at the time of detection.
Data Source
AI summary
A first data object is received for storing in an object repository of a storage platform. An encryption value of the object repository is increased responsive to identifying that a current entropy level of the first data object exceeds a prior entropy level of the first data object by more than a first threshold value. Remediation is performed by a processing device on the object repository responsive to determining that the encryption value of the object repository exceeds a second threshold value.