Ransomware Detection via Resource-Level Entropy Checks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional ransomware detection systems fail to efficiently identify anomalous resources during the data backup process, leading to delayed detection and increased risk of data encryption by ransomware attacks, as they typically do not perform file-by-file analysis due to time and resource constraints.
Innovation Solution
A ransomware detection system that utilizes a machine learning model to perform resource-level anomaly detection, including entropy checks, prior to data transmission to a backup system, allowing for early identification and alerting of anomalous resources, thereby enabling proactive mitigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If file-by-file analysis is performed during backup process, then detection precision is improved, but productivity deteriorates due to time and resource consumption
Solution Approach 1:
The system performs preliminary classification of resources into normal and anomalous categories during the backup process itself, before final backup completion. This allows early detection of ransomware-encrypted files without waiting for the entire backup to finish, resolving the contradiction by enabling precise file-level analysis while maintaining overall backup productivity through parallel processing.
Solution Approach 2:
The backup process is segmented into multiple parallel streams, with anomaly detection operating independently on individual files or file groups. This segmentation allows the system to perform detailed per-file analysis without blocking the entire backup process, thus maintaining productivity while achieving high detection precision.
2Measurement precision
If per-resource level analysis is performed, then detection precision is improved, but loss of time increases due to resource consumption
Solution Approach 1:
The anomaly detection system operates continuously throughout the backup process rather than as a separate post-processing step. Detection activities continue parallel to the backup transmission, utilizing idle computational resources during data transfer, thus achieving high precision without significant additional time loss.
Solution Approach 2:
The system applies partial analysis to all files and excessive (detailed) analysis only to suspicious files identified by preliminary screening. This tiered approach maintains high detection precision while minimizing overall time consumption by avoiding full-depth analysis of every single file.
Data Source
AI summary
A method for detecting, by a ransomware detection system, via at least one resource-level entropy check during a process for transmitting a plurality of resource to a data backup system, a resource in the plurality of resources having an anomalous attribute includes generating, by the ransomware detection system, a first machine learning model associated with a first type of resource associated with at least one resource in the plurality of resources. The ransomware detection system determines that a first resource in the plurality of resources is associated with the first type, the determining occurring prior to transmission of a second resource in the plurality of resources to the data backup system. The ransomware detection system analyzes, using the first machine learning model. The ransomware detection system determines that the first resource is anomalous. The ransomware detection system transmits an alert of the determination that the first resource is anomalous.