Ransomware Detection via Write Request Entropy Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current ransomware detection and prevention methods are inadequate, as they often result in partially encrypted filesystems and lengthy recovery processes, with existing solutions being vulnerable to ransomware overwrites and requiring manual user intervention.
Innovation Solution
A method that determines entropy values for write requests issued by running processes, identifying and preventing unauthorized manipulation by flagging ransomware through a cumulative entropy analysis and managing data synchronization between memory and storage to prevent malicious encryption, using a system that autonomously defends against cryptographic ransomware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional ransomware detection methods monitor file access, permission, API calls, and file type changes, then detection capability is improved, but response time is too slow resulting in partially encrypted filesystems
Solution Approach 1:
The system performs preliminary actions by monitoring write requests before encryption occurs. The entropy analysis is performed on write requests issued by running processes, allowing the system to detect ransomware behavior in advance and prevent the encryption from completing, thus avoiding partially encrypted filesystems.
Solution Approach 2:
The patent replaces traditional mechanical monitoring methods (file access monitoring, permission checking, API call tracking) with an information-theoretic approach using entropy analysis of write requests. This substitution enables faster detection by analyzing the statistical properties of data being written rather than tracking individual operations.
2Ease of repair
If existing solutions use out-of-place writes to flash drives or key escrow mechanisms, then data recovery capability is improved, but the solutions are vulnerable to ransomware overwrites and require manual user intervention
Solution Approach 1:
The system provides self-service protection by automatically detecting and preventing ransomware encryption without requiring manual user intervention. The entropy analysis continuously monitors write requests and automatically blocks suspicious encryption operations, eliminating the need for user action while maintaining reliability against overwrites.
Solution Approach 2:
The patent introduces an intermediary layer between the running process and the storage device. The entropy analysis mechanism acts as a mediator that intercepts write requests, analyzes their properties, and decides whether to allow or block the write operation, thereby preventing direct ransomware overwrites of protected data.
3Measurement precision
If the system continuously monitors all write requests to detect ransomware, then detection accuracy is improved, but performance overhead increases
Solution Approach 1:
The system changes the monitoring parameter from traditional operational parameters (file access count, permission changes, API call frequency) to information-theoretic parameters (entropy of write data). This parameter transformation allows for more accurate detection with lower overhead, as entropy analysis can be performed efficiently on the actual data being written without requiring extensive metadata tracking.
Data Source
AI summary
A method for identifying ransomware in order to prevent unauthorized manipulation of a computer file and/or for preventing unauthorized manipulation of a computer file. The method includes: determining an entropy value in response to a write request issued by a running process; and in response to a determination that the entropy value exceeds a predetermined threshold, identifying the running process as ransomware and/or preventing data stored at a storage device from being manipulated by the running process. Aspects further include: in response to a determination that the entropy value exceeds a predetermined threshold and a determination that a socket request or a delete request was issued by the running process, preventing data stored at a storage device from being manipulated by the running process.