Ransomware Detection via Multi-Frequency Entropy Analysis

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current methods for detecting ransomware infections in file synchronization and sharing networks are inadequate, as they often fail to detect infections early enough to prevent data loss and propagation, and existing entropy analysis methods are ineffective in distinguishing between encrypted files and non-maliciously compressed files.

Innovation Solution

A processor-implemented method that performs low frequency and high frequency entropy analysis on file sections to determine if files are encrypted, using entropy values and probability ratios to set an encryption status condition, and a watcher module to monitor file events for signs of ransomware infection, specifically designed for file synchronization and sharing networks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If existing entropy analysis methods are used to detect encrypted files, then detection capability is provided, but the methods are ineffective in distinguishing between encrypted files and non-maliciously compressed files

Engineering Contradiction:

Improvedetection accuracyVSAvoidfalse positive rate

Core Design Contradiction:

Measurement precisionVSReliability

Solution Approach 1:

The patent segments the entropy analysis into multiple frequency components (low frequency, mid frequency, and high frequency) rather than using a single entropy value. This segmentation allows the system to analyze different aspects of file compression patterns, improving the ability to distinguish between malicious and benign compressed files while reducing false positives

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent changes the parameters of entropy analysis by introducing frequency-based entropy calculations and multiple entropy thresholds. Instead of relying on a single entropy threshold, the system uses multiple parameters (low frequency entropy, mid frequency entropy, high frequency entropy, and their combinations) to make detection decisions, thereby improving both accuracy and reliability

Inventive Principle:

Principle #35Parameter changes

2Loss of time

If early detection of ransomware infections is implemented, then data loss prevention is improved, but detection must occur before traditional methods can identify infections

Engineering Contradiction:

Improvedetection timeVSAvoidinfection detection accuracy

Core Design Contradiction:

Loss of timeVSMeasurement precision

Solution Approach 1:

The patent performs preliminary entropy analysis on files as they are being synchronized or uploaded, before traditional ransomware detection methods would identify them as infected. By analyzing compression patterns early in the file transfer process, the system detects potential ransomware infections before they can propagate or cause data loss, while maintaining detection accuracy through multi-frequency entropy analysis

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS11681802B2Methods and systems for detecting a ransomware attack using entropy analysis and file update patterns

Publication Date: 2023.06.20 DATTO LLC

AI summary

This disclosure and the exemplary embodiments described herein, provide methods and systems for detecting a ransomware infection in one or more files. According to an exemplary embodiment, a low frequency encryption analysis and a high frequency encryption analysis of a plurality of received files is performed to determine if the one or more of the files are encrypted. If a file is encrypted, a watcher is utilized to monitor file events associated with the files for determining if one or more of the files are infected with ransomware.