Ransomware Detection via Snapshot and File-Level ML Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current ransomware detection systems fail to identify specific files impacted by ransomware attacks, as ransomware programs evolve to avoid detection by masking their activity, leading to challenges in understanding which files have been compromised.
Innovation Solution
A computer system employing a funnel-based approach using a snapshot-level machine learning prediction model to determine if a file system has been attacked by ransomware, followed by a file-level machine learning prediction model to classify specific files targeted for encryption, thereby identifying affected files without excessive resource consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If machine learning based ransomware detection systems are introduced, then ransomware detection capability is improved, but the ability to identify specific affected files deteriorates
Solution Approach 1:
The system segments the detection process into two distinct levels: snapshot-level analysis that determines whether ransomware has attacked the file system, and file-level analysis that identifies which specific files are affected. This segmentation allows each level to specialize in its own task, improving both overall detection capability and specific file identification accuracy.
Solution Approach 2:
The patent introduces snapshot metadata as an intermediary layer between the ransomware attack and the detection system. This metadata captures file system state changes without requiring direct analysis of every file, enabling efficient detection while preserving the ability to trace back to specific affected files through the metadata records.
2Measurement precision
If comprehensive file-level analysis is performed to identify all affected files, then identification accuracy is improved, but resource consumption increases excessively
Solution Approach 1:
The system performs preliminary snapshot-level analysis before conducting file-level analysis. By first determining whether ransomware has attacked the file system at the snapshot level, the system avoids performing expensive file-level analysis on unaffected systems, thereby reducing overall resource consumption while maintaining accurate file identification when needed.
Solution Approach 2:
The patent applies partial action by performing file-level analysis only on the subset of files that are relevant to the detected ransomware attack, rather than analyzing every file in the system. This selective approach maintains high identification accuracy while significantly reducing computational resources required.
Data Source
AI summary
Techniques unmasking ransomware attacks are disclosed. In some embodiments, a computer system performs operations comprising: generating a first prediction that a file system comprising a plurality of files has been attacked by ransomware based on snapshot metadata of the file system using a snapshot-level machine learning prediction model, the snapshot metadata comprising a plurality of file change data indicating a plurality of file change events that have been performed on the file system; in response to the first prediction, generating a classification for each one of the files based on the file change data using a file-level machine learning prediction model, the classification indicating whether the files have been targeted by the ransomware for encryption; determining that one or more files have been targeted by the ransomware based on the classification; and displaying the classification for the one or more files on a computing device of a user.