Ransomware Detection via Dynamic Entropy Thresholds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems face challenges in detecting ransomware attacks effectively, as encrypted data can resemble random or typical data patterns, making it difficult to determine appropriate entropy thresholds for detection.
Innovation Solution
A computing system performs sampling of data entropy characteristics by capturing data being transmitted to a storage device, selecting sample data blocks, generating entropy values, and matching these values against precalculated entropy thresholds based on the data blocks' symbol cardinalities, to identify potential ransomware encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a fixed entropy threshold is used for ransomware detection, then the detection process is simple, but the detection accuracy deteriorates when encryption methods change (e.g., base64 encoding)
Solution Approach 1:
The patent applies dynamics by transitioning from a fixed entropy threshold to a dynamic threshold selection mechanism. The system calculates symbol cardinality (the number of distinct symbols) in the encrypted data and selects an appropriate entropy threshold from a predefined set based on this cardinality. This allows the detection system to adapt to different encryption methods and encoding schemes, maintaining high accuracy across various ransomware variants while keeping the overall process simple through automated threshold selection.
2Measurement precision
If multiple entropy thresholds are maintained for different symbol cardinalities, then detection accuracy improves, but device complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-calculating and storing multiple entropy thresholds corresponding to different symbol cardinalities in a lookup table or data structure before runtime. During detection, the system only needs to calculate the symbol cardinality of the incoming data and then retrieve the appropriate threshold from the pre-computed set, rather than performing complex real-time calculations. This approach maintains high detection accuracy across multiple encryption schemes while minimizing runtime complexity through efficient threshold retrieval.
3Reliability
If continuous entropy monitoring is performed, then ransomware detection capability improves, but processing time and computational resources increase
Solution Approach 1:
The patent applies partial action by monitoring only specific characteristics of the data (symbol cardinality and entropy values) rather than performing comprehensive analysis of all data properties. The system samples data blocks, calculates entropy for these samples, and compares against thresholds, which is a partial examination that provides sufficient detection capability without requiring full continuous analysis of every data byte, thereby reducing processing time and computational overhead.
Data Source
AI summary
Example implementations relate to storing data in a storage system. An example includes accessing a first portion of a data stream to be stored in a storage system; selecting sample data blocks included in the first portion; determining entropy values based on the sample data blocks; selecting, based on the sample data blocks, a entropy threshold from multiple precalculated entropy thresholds; determining whether the generated set of entropy values matches the selected entropy threshold within a probability level; and in response to a determination that the generated set of entropy values matches the selected entropy threshold within the probability level, identifying the first portion of the data stream as potentially including encrypted data affected by a ransomware attack.