Object Store Ransomware Detection Using Batchwise IO Metrics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing ransomware detection methods, particularly signature-based approaches, are ineffective against new variants and computationally expensive, failing to timely detect ransomware attacks on object stores, which can encrypt large amounts of data before detection.
Innovation Solution
A machine learning-based system that processes input/output requests to object stores, generating batchwise metrics and feature vectors from temporal sequences of client requests, training a classification model to identify ransomware attacks by analyzing process-specific fields such as PID and disk operations, enabling rapid detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based approaches are used for malware detection, then detection reliability for known malware is improved, but detection reliability for new ransomware variants deteriorates
Solution Approach 1:
The patent transitions from signature-based detection to behavior-based detection by changing the detection parameters from static malware signatures to dynamic behavioral metrics. The system monitors IO request patterns, operation frequencies, and sequence behaviors to detect ransomware, allowing adaptation to new variants without relying on known signatures.
Solution Approach 2:
The patent replaces the mechanical signature-matching system with a machine learning-based behavioral analysis system. Instead of comparing IO requests against predetermined signatures, the system uses trained models to analyze behavioral patterns and detect anomalies indicative of ransomware activity.
2Adaptability or versatility
If machine learning-based behavioral analysis is introduced to detect new ransomware variants, then adaptability to new variants is improved, but computational expense increases
Solution Approach 1:
The patent segments the behavioral analysis into distinct phases: offline model training using labeled datasets, and online inference using the trained model. This segmentation allows computationally intensive training to be performed separately from real-time detection, reducing the computational burden during actual ransomware detection operations.
Solution Approach 2:
The system performs preliminary action by pre-training the machine learning model offline using labeled IO trace data before deployment. This preliminary training phase prepares the model for rapid inference during runtime, eliminating the need for complex real-time computations and reducing operational computational expenses.
3Device complexity
If traditional malware detection methods are used, then device complexity is reduced, but detection accuracy for ransomware deteriorates
Solution Approach 1:
The patent introduces an intermediary layer between raw IO requests and detection decisions. The system uses IO trace sequences as intermediaries to capture behavioral patterns, and machine learning models as intermediaries to translate these patterns into detection decisions. This intermediary layer enables accurate ransomware detection while maintaining relatively simple system architecture.
Data Source
AI summary
The technology disclosed herein provides batchwise metric-based malware detection by receiving a plurality of input/output (IO) requests, generating IO trace sequences by combining a number of IO requests, generating batchwise metrics, each of the batchwise metrics corresponding to one of the IO trace sequences and generated based on an operation performed on values of parameters within IO trace sequences, generating inferential model input feature vectors based on the generated batchwise metrics, and training an inferential model based on a plurality of the generated inferential model input feature vectors and ground truth values corresponding to the IO trace sequences, each of the ground truth values indicating whether a corresponding one of the IO trace sequences represents a ransomware attack.