Object Store Ransomware Detection via IO Trace Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current ransomware detection methods, particularly signature-based approaches and machine learning-based behavioral analysis, are inadequate for timely and accurate identification of ransomware attacks on object stores due to the ease of variant creation and computational expenses.
Innovation Solution
A method involving the collection and processing of input/output (IO) requests to generate condensed IO trace temporal sequences, transformation of fields using one-hot encoding and scaling, and training a machine learning model to classify IO requests as potential ransomware attacks, focusing on server-side monitoring of object store activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning-based behavioral analysis is used for ransomware detection, then detection accuracy improves, but computational cost increases
Solution Approach 1:
The patent segments the IO request data into distinct fields (e.g., operation type, file path, size, timestamp) and processes them separately through specific transformations (one-hot encoding for categorical fields, scaling for numerical fields). This segmentation allows the machine learning model to process only relevant features rather than entire raw datasets, reducing computational overhead while maintaining detection accuracy.
Solution Approach 2:
The patent extracts only the most relevant fields from IO requests for analysis, removing redundant or less informative data. By taking out and focusing on critical features such as operation types, file path patterns, and size changes, the system achieves high detection accuracy with reduced computational requirements compared to analyzing complete raw IO request data.
2Reliability
If signature-based approaches are used for malware detection, then detection reliability improves for known malware, but adaptability to new ransomware variants deteriorates
Solution Approach 1:
The patent implements a dynamic detection system using machine learning that adapts to new ransomware variants by learning from observed IO request patterns. Instead of relying on static signatures, the system continuously analyzes behavioral patterns and adjusts its detection criteria, enabling it to maintain reliability against both known and emerging threats without requiring constant signature updates.
Solution Approach 2:
The patent transforms IO request parameters through encoding and scaling operations, converting raw data into a format that reveals underlying behavioral patterns. By changing the representation of detection parameters (e.g., one-hot encoding operation types, scaling file sizes), the system can identify ransomware behavior across different variants without being constrained by signature matching, thus improving adaptability while maintaining detection reliability.
Data Source
AI summary
The technology disclosed herein provides a method including receiving a plurality of input/output (IO) requests at an object store, removing one or more fields from each of the plurality of input/output (IO) requests to generate a plurality of condensed IO requests, transforming one or more fields of each of the plurality of condensed IO requests to generate transformed IO requests, combining a predetermined number of transformed IO requests to generate IO trace temporal sequences, generating machine learning (ML) model input feature vectors by assigning each of the IO trace temporal sequences a ground truth value indicating whether the IO trace temporal sequence represents a ransomware attack, and training an ML model using a plurality of the ML model input feature vectors.