Ransomware Detection via Storage Controller Discrepancy Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current ransomware detection methods are ineffective against malware that bypasses operating system interfaces by using direct access to storage devices, evading detection and causing unauthorized read/write operations.
Innovation Solution
A method and system that compare block-level access statistics from trusted storage device controllers and untrusted operating system or anti-malware programs to detect discrepancies indicative of ransomware activity, allowing for early detection and remediation actions such as limiting write operations or restoring data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional ransomware detection methods monitor and analyze disk accesses through operating system interfaces, then detection capability is improved for malware using legitimate OS interfaces, but detection effectiveness deteriorates against malware that bypasses OS interfaces by using direct storage device access
Solution Approach 1:
The storage device controller acts as an intermediary between the storage device and the operating system. It collects read/write data from the storage device directly (trusted source) and compares it with read/write data collected by the anti-malware program through OS interfaces (untrusted source). This intermediary mechanism enables detection of direct access attempts by ransomware that bypasses OS interfaces, resolving the contradiction between traditional OS-based detection and the need to detect evasive malware.
Solution Approach 2:
The detection system is segmented into two independent data collection paths: one through the operating system interface (untrusted path) and one through the storage device controller (trusted path). By segmenting the detection architecture, the system can compare data from both paths and identify discrepancies caused by direct access attempts, thereby maintaining detection capability against both legitimate and evasive malware.
2Ease of operation
If anti-malware programs collect read/write data through operating system interfaces, then ease of operation is maintained, but measurement precision deteriorates because the data source becomes untrusted when ransomware bypasses OS interfaces
Solution Approach 1:
The storage device controller serves as a trusted intermediary that directly collects read/write data from the storage device, bypassing the untrusted OS interface layer. This trusted data source compensates for the imprecision of untrusted OS-based collection, enabling accurate detection while maintaining operational simplicity through automated comparison of both data sources.
Solution Approach 2:
The system continuously compares read/write data from the trusted storage device controller with data from the untrusted OS interface, using feedback loops to detect discrepancies. When mismatches are detected, the system triggers alerts or remediation actions, ensuring measurement precision is maintained through constant validation of data integrity.
Data Source
AI summary
A system and method of detecting and remediating attacks includes receiving operating system (OS) read/write data from an OS, the OS read/write data describing at least one of reads from and writes to a storage device over a file system interface of the OS; collecting storage device read/write data, the storage device read/write data describing at least one of reads from and writes to the storage device; comparing the OS read/write data to the storage device read/write data; and determining if there is a discrepancy between the OS read/write data and the storage device read/write data. If there is a discrepancy, determining if there is an anomaly detected between OS read/write data and the storage device read/write data. If there is an anomaly, causing a remediation action to be taken to stop a malware attack.