Per-Resource Anomaly Detection for File-Level Ransomware Signals
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anomaly detection systems are computationally inefficient and impractical for timely ransomware detection due to reliance on file entropy calculations and querying persistent storage, leading to delayed detection and inadequate results.
Innovation Solution
A ransomware detection system that analyzes ransomware signals in a backup data stream on a file-by-file basis, using a tracking component to execute entropy calculations and file extension analysis without querying persistent storage, and employs a machine learning engine with online learning and pruning mechanisms to enhance computational efficiency and accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional anomaly detection systems calculate file entropy through sampling and query persistent storage, then they can analyze files for ransomware signals, but the detection time is delayed and computational resources are consumed excessively
Solution Approach 1:
The system performs preliminary actions by calculating file entropy and analyzing file extensions in real-time during the backup data stream processing, before any ransomware detection is needed. This eliminates the need for subsequent queries to persistent storage and enables immediate detection when ransomware activity occurs.
Solution Approach 2:
The patent replaces the mechanical process of querying persistent storage and retrieving file data with a streamlined real-time analysis approach. The system substitutes the slow disk I/O operations with in-memory entropy calculations and pattern matching during the backup stream processing, dramatically reducing detection time.
2Measurement precision
If conventional systems execute entropy calculations after file backup data stream is completed, then they can analyze files, but the process is computationally costly and requires API calls to persistent storage
Solution Approach 1:
The system performs entropy calculations and file analysis preliminarily during the backup data stream processing itself, rather than after completion. This preliminary action eliminates the need for subsequent computationally intensive queries to persistent storage and API calls, reducing overall computational resource consumption.
Solution Approach 2:
The patent implements continuous entropy calculation and file extension analysis during the backup data stream processing, maintaining useful action throughout the process rather than performing analysis in discrete batches after completion. This continuous approach eliminates idle computational cycles and reduces total resource consumption.
3Productivity
If conventional anomaly detection systems use sampling to calculate file entropy, then they can process files, but they leave substantial gaps in ransomware detection capabilities
Solution Approach 1:
The system segments the file analysis process into two independent components: real-time entropy calculation during backup stream processing and separate file extension pattern analysis. This segmentation allows both processes to run in parallel without compromising either efficiency or detection coverage, eliminating the gaps left by sampling approaches.
Solution Approach 2:
By performing complete file analysis (both entropy calculation and extension checking) as a preliminary action during backup processing, the system ensures thorough ransomware detection coverage for all files without requiring subsequent sampling or batch processing that would leave detection gaps.
Data Source
AI summary
Disclosed herein are system, method, and computer program product embodiments for detecting ransomware and creating ransomware incidents by way of analyzing for ransomware signals in a backup data stream on a file-by-file basis. The ransomware detection system comprises a ransomware detection engine that includes a tracking component. The tracking component may track the byte distribution and extension of a file from a backup data stream. Further, the tracking component may perform a ransomware analysis on the file and identify, using a machine learning model, that the file is encrypted by ransomware based on an anomaly score and a confidence threshold. Subsequently, the tracking component may create a ransomware incident based on the identification that the file is encrypted by ransomware. Disclosed herein are additional embodiments directed towards training and updating a machine learning model within the ransomware detection engine.