Ransomware-Aware Backup Delta-Scoring and Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ransomware encryption poses a significant threat to data recovery, as existing backup systems may inadvertently propagate the infection by synchronizing encrypted files, and traditional prevention methods focus on denying access rather than effective recovery strategies.
Innovation Solution
An intelligent backup system that computes a delta-score for each backup transaction by analyzing changes in file characteristics, such as new, missing, or modified files, and entropy levels, to detect potential ransomware infections and implement counter-measures like alerting users, quarantining data, and maintaining multiple backup versions to facilitate recovery.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional backup systems synchronize files to cloud storage, then data availability is improved, but ransomware infection propagation risk increases
Solution Approach 1:
The system performs preliminary analysis of backup transactions before completing synchronization. It computes delta-scores and detects ransomware infections in advance, preventing infected files from being synchronized to cloud storage. This preliminary detection mechanism blocks the propagation pathway while maintaining normal backup operations for clean files.
Solution Approach 2:
The system introduces an intermediary detection layer between the local backup source and cloud storage destination. This intermediary analyzes file characteristics, computes entropy scores, and determines whether files are infected before allowing synchronization. The intermediary acts as a filter that permits legitimate backups while blocking ransomware propagation.
2Measurement precision
If backup systems perform comprehensive file analysis to detect ransomware, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The system applies different levels of analysis to different files based on their risk characteristics. It computes delta-scores that measure the degree of change in file properties, and applies entropy analysis selectively. Files with normal change patterns receive minimal processing, while files with suspicious characteristics trigger more intensive analysis, optimizing the balance between detection accuracy and processing speed.
Solution Approach 2:
The system changes the parameters of analysis based on the backup transaction context. It dynamically adjusts the threshold for triggering entropy analysis based on the computed delta-score. When delta-scores indicate normal backup activity, the system uses faster, less intensive methods. When delta-scores suggest potential infection, the system activates more comprehensive entropy-based analysis to improve detection accuracy.
Data Source
AI summary
In one embodiment, a method for ransomware-aware file backup is implemented on a computing device and includes: backing up a target population of files from a target file location in a backup transaction, computing a backup delta score for the backup transaction, where the computing comprises comparing backup data from the backup transaction with backup data from a previous backup transaction, determining whether the computer backup delta score exceeds a pre-defined threshold, and upon the computed backup delta score exceeding the pre-defined threshold: determining that the backup transaction is indicative of a ransomware infection, and performing at least one counter-measure in response to the ransomware infection.