Ransomware Detection via Audit Log Pattern Recognition
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional solutions for detecting and protecting against ransomware attacks in distributed file systems are not scalable and are prohibitively expensive, as they rely on intrusive methods that do not effectively monitor file system activity in detail, especially in large deployments like IBM Spectrum Scale, where lightweight solutions with low resource consumption are needed.
Innovation Solution
A computer-implemented method that monitors file access activity, generates an audit log, collects file usage samples, runs a pattern recognition algorithm to detect malware activity, and restores files based on the audit log, utilizing file system facilities like audit logs, filter drivers, and lightweight events to limit damage and enable recovery.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional ransomware detection solutions are deployed in distributed file systems, then malware detection capability is improved, but device complexity and resource consumption increase significantly
Solution Approach 1:
The patent introduces an intermediary pattern recognition algorithm that analyzes file access patterns through audit logs without requiring direct intrusion into the file system. This intermediary layer detects ransomware behavior by monitoring sequential read-write patterns on multiple files, providing detection capability while maintaining system architecture integrity and avoiding direct interference with file system operations.
Solution Approach 2:
The patent replaces complex mechanical intrusion methods (kernel modules, hooks, sniffers) with a lightweight software-based pattern recognition system. Instead of using intrusive mechanical means to detect ransomware, the system substitutes these with algorithmic analysis of audit log patterns, significantly reducing device complexity and resource consumption while maintaining detection effectiveness.
2Measurement precision
If intrusive detection methods are used to monitor file system activity, then malware detection accuracy is improved, but ease of operation and resource consumption worsen
Solution Approach 1:
The patent extracts only the essential file access pattern information needed for ransomware detection from the audit logs, rather than implementing comprehensive intrusive monitoring. By taking out only the critical sequential read-write patterns on multiple files, the system achieves sufficient detection accuracy without the operational complexity of full intrusive monitoring implementations.
Solution Approach 2:
The patent applies partial action by monitoring only specific file access patterns characteristic of ransomware (sequential reads followed by writes on multiple files) rather than all file system activities. This partial monitoring approach provides adequate detection precision for ransomware while significantly reducing the operational burden and resource consumption compared to comprehensive monitoring.
3Reliability
If comprehensive file system monitoring is implemented, then malware activity detection is improved, but resource consumption and operational costs increase
Solution Approach 1:
The patent implements partial monitoring by focusing only on the specific file access patterns that characterize ransomware attacks (sequential reads followed by writes across multiple files). This selective approach provides sufficient detection reliability for ransomware threats while consuming minimal system resources, avoiding the excessive resource consumption of comprehensive monitoring.
Solution Approach 2:
The patent uses lightweight, disposable audit log entries as the basis for detection rather than implementing persistent, resource-intensive monitoring agents. By analyzing inexpensive audit log data for patterns indicative of ransomware, the system achieves reliable detection with minimal resource consumption, treating each detection cycle as a lightweight operation rather than a heavy continuous process.
4Use of energy by moving object
If lightweight detection solutions are used, then resource consumption is reduced, but measurement precision of file access patterns deteriorates
Solution Approach 1:
The patent changes the parameter of analysis from detailed individual file operations to aggregated sequential patterns across multiple files. By transforming the measurement parameters to focus on the sequence and frequency of read-write operations rather than individual file details, the system maintains adequate detection precision with lightweight resource consumption.
Solution Approach 2:
The patent creates a universal pattern recognition algorithm that can detect ransomware through multiple different file access patterns. This multi-functional approach allows the lightweight solution to maintain precision by recognizing various ransomware behaviors (sequential reads, rapid writes, multiple file targets) through a single versatile detection mechanism rather than requiring specialized heavy-duty analysis for each pattern type.
Data Source
AI summary
A computer-implemented method includes monitoring file access activity and generating an audit log based on the file access activity. The method also includes collecting samples of file usage activity, running a pattern recognition algorithm on the samples of the file usage activity for detecting malware activity, and, in response to detecting malware activity, restoring at least one file based on the audit log. A computer program product includes one or more computer readable storage media and program instructions collectively stored on the one or more computer readable storage media. The program instructions include program instructions to perform the foregoing method. A system includes a processor and logic integrated with the processor, executable by the processor, or integrated with and executable by the processor. The logic is configured to perform the foregoing method.