Ransomware Detection via File Replication Logs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-malware programs do not guarantee protection against ransomware infections, as they may not be installed on every endpoint and are ineffective against new forms of ransomware, which encrypt files to extort ransoms, with no guarantee of file decryption even after payment.
Innovation Solution
A device in a network monitors file replication logs to track encryption changes, determining if they indicate a ransomware infection, and initiates mitigation actions, such as retaining unencrypted file backups and locking files from further encryption, without requiring anti-malware software on the endpoint client.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-malware programs are installed on endpoints to detect ransomware, then endpoint protection capability is improved, but device complexity and installation coverage are worsened
Solution Approach 1:
The patent introduces a file replication service as an intermediary between the endpoint client and the protection system. Instead of installing complex anti-malware software directly on endpoints, the system uses the file replication service to monitor file changes and detect encryption patterns, thereby improving ransomware detection while avoiding the complexity and coverage issues of endpoint installation
Solution Approach 2:
The patent replaces the mechanical approach of installing software agents on endpoints with a remote monitoring approach. The file replication service remotely observes file changes and detects ransomware encryption patterns through log analysis, eliminating the need for complex endpoint software installation while maintaining detection capability
2Reliability
If traditional anti-malware programs are used to prevent ransomware, then some endpoint protection is provided, but adaptability to new ransomware forms is worsened
Solution Approach 1:
The patent changes the detection parameter from relying on known malware signatures to monitoring file encryption patterns and replication log changes. This parameter change enables the system to detect new ransomware forms based on their behavioral characteristics (encrypting files and attempting replication) rather than requiring updates to signature databases, thereby improving adaptability while maintaining protection effectiveness
Solution Approach 2:
The system implements feedback by continuously monitoring file replication logs and analyzing encryption patterns. When new encryption patterns are detected, the system learns from these observations and adjusts its detection criteria, enabling automatic adaptation to new ransomware variants without requiring manual updates or endpoint software changes
3Measurement precision
If file replication monitoring is implemented to detect ransomware, then detection accuracy is improved, but information loss from encrypted files is worsened
Solution Approach 1:
The patent applies preliminary action by maintaining backups of unencrypted files through the file replication service before ransomware encryption occurs. The system monitors replication logs to detect encryption attempts and preserves the original unencrypted versions in the replication service, thereby enabling accurate detection while preventing information loss through pre-encryption backups
Solution Approach 2:
The system uses copying by creating and maintaining duplicate versions of files through the file replication service. The original unencrypted files are copied to the replication service, and when ransomware encrypts the local files, the unencrypted copies remain available in the replication service, thus achieving both accurate detection and preservation of original data
Data Source
AI summary
In one embodiment, a device in a network obtains log data regarding replication of files stored on an endpoint client to a file replication service. The device tracks, based on the obtained logs, encryption changes to the files that convert the files from unencrypted files to encrypted files. The device determines that the tracked encryption changes to the files are indicative of a ransomware infection on the endpoint client. The device initiates a mitigation action regarding the ransomware infection.