Ransomware Detection in Continuous Data Protection via Entropy Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ransomware attacks pose a significant threat in continuous data protection environments, where attackers encrypt files, making recovery dependent on a secret key held by the attacker, and existing systems lack effective detection and mitigation methods.
Innovation Solution
A method and system that intercept write requests from hosts to storage, calculate the probability of ransomware presence, and take mitigation actions such as creating a bookmark or delaying acknowledgments based on calculated probabilities, using entropy analysis and prior encryption data to differentiate between expected and actual encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If continuous data protection is implemented to protect against disasters, then data recovery capability is improved, but vulnerability to ransomware attacks increases because encrypted files cannot be recovered without the attacker's secret key
Solution Approach 1:
The system performs preliminary actions by creating bookmarks at specific points in the continuous data protection stream before ransomware encryption occurs. These bookmarks serve as pre-prepared recovery points that allow rapid restoration without requiring decryption keys, thus preventing the harmful effect of ransomware while maintaining data protection capabilities
Solution Approach 2:
The system detects ransomware encryption behavior and converts this harmful event into a beneficial opportunity by automatically creating bookmarks at the point of detection. The ransomware attack itself triggers the creation of safe recovery points, transforming the harmful encryption activity into a useful protective mechanism
2Measurement precision
If entropy analysis is used to detect ransomware by analyzing write data, then detection accuracy is improved, but system complexity increases due to additional analysis requirements
Solution Approach 1:
The system uses entropy analysis that leverages the inherent statistical properties of encrypted data without requiring external expertise or complex algorithms. The entropy calculation itself serves as the detection mechanism, using the self-evident randomness characteristic of encryption to identify ransomware activity automatically
Solution Approach 2:
The system replaces complex behavioral analysis or signature-based detection mechanisms with a simpler statistical approach using entropy calculation. This substitution reduces computational complexity while maintaining high detection accuracy by relying on the fundamental mathematical property that encrypted data exhibits high entropy
3Reliability
If bookmarks are created when ransomware probability is between thresholds, then recovery options are improved, but storage overhead increases due to additional metadata
Solution Approach 1:
The system applies bookmarks selectively at specific locations in the data protection stream where ransomware detection occurs, rather than uniformly throughout. This localized approach creates recovery points only where needed, improving recovery options while minimizing unnecessary metadata storage overhead in clean data segments
4Object-affected harmful factors
If delayed ACK is sent when ransomware probability exceeds threshold, then ransomware propagation is slowed, but system performance decreases due to write operations being delayed
Solution Approach 1:
The system dynamically adjusts the ACK response based on the calculated ransomware probability. When probability is low, normal immediate ACKs maintain high performance. When probability exceeds thresholds, delayed ACKs slow propagation. This dynamic adaptation allows the system to optimize between security and performance based on real-time conditions rather than using a fixed approach
Data Source
AI summary
A computer program product, system, and method for generating coded fragments comprises intercepting, at a splitter, a write request from a host to storage, the write request comprising write data; sending the write request to a data protection appliance (DPA); calculating a probability of ransomware within the host; if the probability of ransomware is less than or equal to a first threshold, sending an acknowledgement (ACK) to the splitter; if the probability of ransomware is greater than a first threshold value and less than or equal to a second threshold value, creating a bookmark and sending an ACK to the splitter; and if the probability of ransomware is greater than the second threshold value, sending a delayed ACK to the splitter.