Ransomware Detection via Deduplication Ratio Anomalies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing deduplication storage systems face challenges in detecting ransomware attacks efficiently, as traditional methods require significant computing resources and may not detect encryption until after data has been overwritten.
Innovation Solution
A deduplication storage system controller performs a matching operation against a container index to deduplicate data units, calculates a deduplication ratio, and compares it to local ratio history data. If the ratio exceeds a predetermined condition, the system identifies potentially encrypted data units as potentially affected by ransomware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional ransomware detection methods are used, then detection capability is provided, but computing resources are significantly consumed
Solution Approach 1:
The system performs preliminary deduplication operations and maintains local ratio history data before ransomware attacks occur. By pre-establishing the baseline deduplication ratios through normal operations, the system can quickly detect anomalies without requiring heavy computational resources during actual detection, thus resolving the contradiction between detection reliability and computing resource consumption
Solution Approach 2:
The patent replaces traditional complex ransomware detection mechanisms with a simplified ratio comparison approach. Instead of using resource-intensive signature matching or behavioral analysis, the system substitutes these with lightweight deduplication ratio calculations against pre-stored local history data, achieving effective detection with minimal computing resources
2Reliability
If traditional ransomware detection methods are used, then detection is provided, but detection occurs after data has been overwritten
Solution Approach 1:
The system continuously performs preliminary deduplication operations and updates local ratio history data in real-time during normal storage operations. This preliminary action establishes a baseline of normal deduplication behavior before ransomware attacks, enabling immediate detection when anomalies occur without time loss for post-attack analysis
Solution Approach 2:
The deduplication and ratio monitoring operations continue uninterrupted during normal storage operations. By maintaining continuous monitoring of deduplication ratios against local history data, the system ensures that ransomware detection is an ongoing process rather than a periodic check, eliminating detection delays and enabling immediate identification of encryption events
Data Source
AI summary
Example implementations relate to deduplication operations in a storage system. An example includes receiving data units of a backup stream to be stored in a deduplication storage system; performing a first matching operation to match the data units against a first container index of a plurality of container indexes, where the plurality of container indexes comprise metadata indicating storage locations of data units previously stored in the persistent storage; calculating a first ratio indicating the amount of deduplication that occurred during the first matching operation against the first container index; and in response to a determination that the first ratio violates a condition with respect to local ratio history data of the first container index, identifying at least one portion of the backup stream as being potentially affected by a ransomware attack.