Ransomware Detection via File System Behavior Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-virus based approaches fail to detect unknown ransomware, and backup systems can be compromised or outdated, leading to inefficiencies in detecting and recovering from ransomware infections.
Innovation Solution
The system analyzes read and write requests to a file system to determine the likelihood of a ransomware attack by calculating ratios, entropy, and compression ratios, and performs mitigation actions such as generating alerts, storing unmodified file blocks, and disconnecting infected clients to prevent further damage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-virus based approaches are used to detect ransomware, then known ransomware can be detected, but unknown ransomware variants cannot be detected
Solution Approach 1:
The system changes the detection parameters from static virus signatures to dynamic behavioral parameters including read/write request ratios, entropy values, and compression ratios. These parameters are continuously monitored and analyzed to detect ransomware based on its operational behavior rather than predefined signatures, enabling detection of unknown variants while maintaining reliability for known threats
Solution Approach 2:
The patent replaces the mechanical signature-matching system with an information-theoretic analysis system that calculates entropy and compression ratios of file operations. This substitution enables the system to detect ransomware based on mathematical properties of encrypted data (high entropy, poor compressibility) rather than relying on mechanical pattern matching against known signatures
2Reliability
If backup systems are used for recovery, then data can be restored, but backups can be compromised or outdated
Solution Approach 1:
The system performs preliminary actions by continuously monitoring file system operations and detecting ransomware attacks in real-time before complete encryption occurs. Once detected, the system immediately isolates affected files and preserves their original state, enabling rapid recovery without waiting for backup cycles to complete
Solution Approach 2:
The patent introduces an intermediary detection and response layer between the ransomware and the file system. This intermediary system monitors operations, identifies malicious activity, and intercepts encryption attempts by preserving file states and triggering recovery procedures, acting as a mediator that protects the backup system from being compromised while enabling faster recovery
3Object-affected harmful factors
If ransomware detection and response systems are implemented, then attack impact can be reduced, but system complexity increases
Solution Approach 1:
The detection system is segmented into distinct functional modules: a monitoring component that collects read/write request data, an analysis component that calculates entropy and compression ratios, and a response component that executes mitigation actions. This segmentation reduces overall system complexity by making each module independent and manageable while collectively providing comprehensive ransomware protection
Data Source
AI summary
Systems and techniques are described to detect and recover from ransomware infections. It may be determined if a ransomware attack is in progress based on analyzing read and write requests to a file system. Next, a mitigation action may be performed in response to determining that a ransomware attack is in progress.