Ransomware Detection via Block Change Rate Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current ransomware detection methods fail to detect attacks early enough, leading to substantial data loss, as they typically detect encryption only after the filesystem has been compromised, and snapshot-based backups require knowledge of the infection time to recover data, resulting in high recovery times and loss of recent changes.
Innovation Solution
Implementing a method that performs snapshot backups at predetermined intervals, calculates an interval malware index value to detect unusual changes, and triggers an emergency snapshot when the index exceeds a threshold, allowing for immediate detection and protection of recently changed data without requiring knowledge of the infection time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of substance
If snapshot backups are performed at predetermined intervals, then data loss is minimized, but detection of ransomware attacks occurs too late after substantial encryption has already happened
Solution Approach 1:
The system performs preliminary actions by continuously monitoring block change rates between snapshots and calculating malware index values to detect ransomware attacks before substantial data loss occurs. This preliminary detection enables early intervention rather than waiting for the next scheduled snapshot.
Solution Approach 2:
The system implements feedback by continuously monitoring block change rates, calculating malware index values, and comparing them against thresholds to detect anomalies. This feedback loop enables real-time detection of ransomware activity between scheduled snapshots, allowing the system to respond to attacks as they unfold.
2Reliability
If traditional backup methods are used, then detection of ransomware is achieved, but recovery time is high and requires knowledge of infection time
Solution Approach 1:
The system prepares emergency snapshots in advance by continuously monitoring and detecting ransomware activity before it completes encryption. This preliminary detection and response action eliminates the need for lengthy recovery processes and removes the requirement to know the exact infection time, as the system automatically identifies attacks through block change rate analysis.
3Measurement precision
If frequent snapshot backups are performed, then detection accuracy is improved, but system performance and storage resources are consumed
Solution Approach 1:
The system applies partial monitoring by focusing specifically on block change rates rather than performing full filesystem analysis. This selective approach maintains high detection accuracy by monitoring the specific metric (block changes) that indicates ransomware activity, while consuming fewer system resources compared to comprehensive scanning methods.
Data Source
AI summary
A method, computer program product, and system for detecting and mitigating ransomware using snapshot-based backups applied to a block-oriented storage device, by performing the following operations: (i) performing, in predetermined time-intervals, snapshot backups of data in a block-oriented storage device; (ii) determining at least one interval malware index value between a last snapshot backup and a next planned snapshot backup, wherein the interval malware index value is indicative of a changed block rate in stored data of storage blocks of the block-oriented storage device; and (iii) in response to determining that the interval malware index value is larger than a predefined interval malware index threshold value, triggering an emergency snapshot.