Ransomware-Encrypted File Detection Using Multi-Region Byte Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing ransomware detection methods, particularly those based on static and dynamic rules, are ineffective against modern, covert, and customized encryption processes, leading to missed detections or false positives, and resource-intensive real-time monitoring.
Innovation Solution
A method involving extracting bytes from different file portions (header, middle, and trailer) to analyze the variance of character distributions using multiple machine learning models for in-depth analysis to detect ransomware-encrypted files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If static and dynamic rule-based methods are used for ransomware detection, then the detection process is simple to implement, but the detection accuracy is low and false positives occur frequently
Solution Approach 1:
The patent replaces traditional mechanical rule-based detection systems with machine learning models that automatically learn detection patterns from data. Multiple ML models analyze file features and provide probability distributions, substituting manual rule creation with automated intelligent analysis that achieves higher accuracy while maintaining ease of deployment.
Solution Approach 2:
The patent changes the detection parameters from fixed static/dynamic rules to probabilistic outputs from multiple machine learning models. By aggregating probability distributions from several models and comparing against a threshold, the system achieves higher detection accuracy while keeping the implementation straightforward through standardized probability aggregation.
2Speed
If real-time monitoring is implemented to detect ransomware, then the detection speed is improved, but the resource consumption increases significantly
Solution Approach 1:
The patent applies partial action by using multiple machine learning models rather than requiring all possible analysis methods. The system processes files through several models in parallel, obtaining probability distributions from each, and aggregates these results. This approach achieves high detection speed through parallel processing while consuming reasonable resources by avoiding exhaustive analysis of every file.
Solution Approach 2:
The patent segments the detection process into multiple independent machine learning models that operate in parallel. Each model processes file features independently and outputs a probability distribution, which are then aggregated. This segmentation enables concurrent processing for fast detection while distributing resource consumption across multiple specialized models rather than one resource-intensive system.
3Measurement precision
If multiple machine learning models are used for file analysis, then the detection precision is improved, but the computational complexity increases
Solution Approach 1:
The patent merges the outputs of multiple machine learning models by aggregating their probability distributions. Instead of maintaining separate complex decision systems, the system combines the probabilistic outputs from each model and compares the aggregated result against a threshold. This merging approach maintains high detection precision while simplifying the overall computational structure through unified probability aggregation.
Solution Approach 2:
The patent uses multiple copies of machine learning models that each independently analyze file features. Rather than creating one highly complex model, the system deploys several standardized model copies that process data in parallel. Each model copy is relatively simple, but their combined outputs through probability aggregation achieve high detection precision while keeping individual model complexity manageable.
Data Source
AI summary
A method for detecting a ransomware-encrypted file includes: acquiring a designated file; extracting bytes from a file header, a file middle portion and a file trailer of the designated file respectively; extracting features from the extracted bytes, where the extracted features include at least a variance of a distribution of a first preset type of characters; inputting the extracted features into more than one first machine learning model to obtain a probability distribution, outputted by each of the more than one first machine learning model, indicating a likelihood that the designated file is ransomware-encrypted; and determining, based on the probability distribution, whether the designated file is ransomware-encrypted. The present disclosure improves efficiency and accuracy of ransomware detection by extracting bytes and features from different portions of the designated file and utilizing a plurality of machine learning models for ransomware detection.