Ransomware Detection via Semantic Feature Distance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional backup solutions cannot effectively distinguish between clean and corrupted files, leading to the backup of unclean files and rendering backup snapshots useless in the event of a ransomware attack.
Innovation Solution
A ransomware detection method and system that detect substantial changes in at least one semantic feature of a file, allowing for the identification of clean or unclean file versions and ensuring that only clean versions are backed up.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional backup solutions backup all files without distinction, then backup simplicity is maintained, but backup reliability deteriorates when ransomware attacks occur
Solution Approach 1:
The system performs preliminary detection of file corruption by comparing semantic features of current files with their backup versions before the backup operation completes. This preliminary action identifies corrupted files and prevents them from being backed up, or marks them for exclusion from the backup snapshot.
Solution Approach 2:
The patent introduces an intermediary detection mechanism that acts between the file system and the backup system. This intermediary component analyzes semantic features of files and provides classification (clean/unclean) to the backup system, enabling intelligent backup decisions without requiring complex integration with multiple security systems.
2Quantity of substance
If backup solutions delete oldest versions to make room for new versions, then storage efficiency is improved, but loss of information increases when clean versions are deleted
Solution Approach 1:
The system implements feedback by continuously monitoring file versions and their semantic features, comparing current versions with previous versions to detect corruption. This feedback mechanism allows the backup system to identify which versions are clean and which are corrupted, enabling intelligent retention decisions that prevent deletion of clean versions while maintaining storage efficiency.
Solution Approach 2:
The patent changes the parameter used for version identification from simple timestamps or sequence numbers to semantic feature-based classification. By using semantic feature distance as a detection parameter, the system can distinguish between legitimate version changes and ransomware corruption, enabling more intelligent backup management that prevents loss of clean versions.
3Adaptability or versatility
If unlimited backup snapshots are maintained, then recovery options increase, but device complexity and storage requirements increase
Solution Approach 1:
The system extracts and analyzes only the essential semantic features of files for comparison purposes, rather than storing and managing complete file versions indefinitely. This extraction approach reduces the complexity of managing unlimited snapshots while maintaining the ability to identify clean versions for recovery.
Solution Approach 2:
The patent replaces mechanical backup management (simple copy-and-store operations) with a more intelligent system that uses semantic feature comparison to automatically identify and protect clean versions. This substitution reduces operational complexity by automating the detection and protection processes.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A detection method for ransomware for use in a detection system (1) having a semantic extracting module (12) with multiple semantic extractors (121) is disclosed, and includes following steps: receiving a first file (2) with a first ID; importing the first file (2) to the semantic extracting module (12) to output a first semantic feature of the first file (2); receiving a second file (3) with a second ID; importing the second file (3) to the semantic extracting module (12) to output a second semantic feature of the second file (3); computing a distance (D) between the first semantic feature and the second semantic feature if the second ID matches the first ID; and, issuing an alarm when the distance (D) exceeds a threshold.