Ransomware Detection via File System Virtualization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems for ransomware detection struggle to identify new variants due to the flexibility of ransomware deployment, which can spread across multiple processes or execute outside the execution environment, making signature-based and binary analysis ineffective.
Innovation Solution
A processor-implemented method that monitors file system events for ransomware attacks, performs behavioral analysis, virtualizes the file system for anomalous behavior, and checks reference databases for matches, with behavioral and structural analysis to update global databases for new threat features.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection or binary analysis is used, then detection of known ransomware is improved, but detection of new ransomware variants fails due to flexibility in deployment across multiple processes or external execution environments
Solution Approach 1:
The system transitions from static signature-based detection to dynamic behavioral analysis that monitors file system events and process actions in real-time. The detection mechanism adapts to new ransomware variants by observing actual runtime behavior patterns rather than relying on pre-defined signatures, enabling the system to detect novel threats that have not been previously identified.
Solution Approach 2:
The patent introduces a virtualized file system as an intermediary layer between the ransomware process and the actual file system. This mediator captures and analyzes file access behaviors, allowing the system to detect ransomware activities through behavioral patterns in the virtualized environment before actual damage occurs to the real file system.
2Reliability
If behavioral analysis is performed on all file system events, then detection capability is improved, but system performance deteriorates due to computational overhead
Solution Approach 1:
The system performs behavioral analysis selectively rather than comprehensively on all file system events. It focuses analysis on specific suspicious patterns and high-risk operations identified through the virtualized file system monitoring, applying full behavioral analysis only when anomaly thresholds are exceeded, thus reducing overall computational overhead while maintaining detection reliability.
Solution Approach 2:
The detection system is segmented into multiple layers: virtualized file system monitoring captures all events, reference databases filter known patterns, and behavioral analysis focuses on suspicious anomalies. This segmentation allows the system to process events efficiently at each layer, performing computationally intensive behavioral analysis only on a small subset of potentially malicious events.
3Object-affected harmful factors
If file system virtualization is implemented for all processes, then protection against ransomware is improved, but device complexity increases
Solution Approach 1:
The virtualized file system serves as an intermediary that provides protection without requiring fundamental changes to the operating system architecture. It creates a virtual layer that intercepts and monitors file operations, allowing the system to protect against ransomware while maintaining compatibility with existing processes and minimizing architectural complexity.
Solution Approach 2:
The virtualized file system is designed to work universally with all applications and processes without requiring process-specific modifications. It provides a general-purpose protection mechanism that handles diverse file system operations through a unified interface, reducing the complexity that would arise from implementing separate protection mechanisms for different process types.
Data Source
AI summary
This disclosure relates generally to malware detection, and more particularly to system and method for detecting and mitigating ransomware threats. For a User Equipment being monitored, the system performs a behavior analysis of corresponding file system to determine whether any anomalous behavior that would amount to a ransomware threat is associated with flies associated with the file system change, if present, then the system virtualizes the file system on the fly. If information pertaining to the identified anomalous behavior is present in any of the reference databases in the system, then all the I/O calls are terminated or the file system is virtualized for rest of the session. If data pertaining to the identified anomalous behavior is not found in any of the associated databases, then new behavioral features and structural patterns of the identified anomalous behavior and the associated processes are extracted, and the reference databases are updated accordingly.