Ransomware Detection via File Entropy Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques fail to effectively detect and block ransomware in real-time, especially with polymorphic variants and zero-day vulnerabilities, leading to unsolicited encryption of computer files and loss of user data, as they require frequent updates and are not always effective against advanced threats.
Innovation Solution
A method that monitors file system access, measures the randomness of data before and after processing, compares these values, and interrupts suspicious processes, requesting user acknowledgment for legitimate encryption, while automatically attempting to recover encryption keys from volatile memory to prevent ransomware operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based antivirus detection is used, then known malware can be detected, but zero-day attacks and polymorphic ransomware remain undetected
Solution Approach 1:
The patent changes the detection parameter from static signature matching to dynamic statistical analysis of data transformations. By measuring entropy changes, data distribution shifts, and statistical anomalies during file processing, the system can detect ransomware behavior patterns regardless of specific encryption algorithms or file types, enabling detection of zero-day attacks and polymorphic variants.
Solution Approach 2:
The patent replaces the mechanical signature-matching approach with a statistical analysis system. Instead of comparing file hashes against a database of known signatures, the system uses random forest classifiers and statistical models to analyze transformation patterns, allowing it to identify malicious behavior based on learned anomalies rather than explicit rules.
2Reliability
If real-time monitoring of file encryption is implemented, then ransomware can be blocked, but system performance and resource consumption increase
Solution Approach 1:
The patent applies partial monitoring by focusing statistical analysis only on critical file operations that show suspicious patterns, rather than continuously analyzing all file access. The system monitors specific parameters like entropy changes, data distribution shifts, and transformation statistics only when anomalies are detected, reducing computational overhead while maintaining effective protection.
Solution Approach 2:
The system performs preliminary statistical baseline establishment during normal operation, learning typical data transformation patterns before ransomware attacks occur. This pre-trained knowledge enables rapid anomaly detection during actual threats without requiring intensive real-time computation, as the classification model can quickly compare current operations against established baselines.
3Reliability
If frequent antivirus database updates are performed, then detection accuracy improves, but system downtime and update complexity increase
Solution Approach 1:
The patent implements self-service through automated statistical baseline updates and anomaly detection. The system continuously learns from legitimate file operations and automatically adjusts its detection models without requiring manual intervention or database updates. This eliminates the need for periodic antivirus signature updates while maintaining high detection accuracy against evolving ransomware threats.
Solution Approach 2:
The system incorporates feedback mechanisms where detected anomalies and false positives are fed back into the statistical models to refine future detection. This continuous learning process allows the system to adapt to new ransomware variants without external updates, maintaining detection accuracy while eliminating update downtime and reducing operational complexity.
Data Source
Figure 1
AI summary
A method for real time protection against unsolicited encryption of computer files in a computer system, particularly as a result of operation of ransomware in the computer system, is provided. The method comprises the following steps: monitoring an access of a running process to a file of a file system, the file being in a first state in which it is accessed as input by the process and in a second state in which the file is processed by the process as output, the first state of the file of the file system being associated with a first set of data values and the second state of the file of the file system being associated with a second set of data values, measuring a first magnitude representative of the randomness of the first set of data values and a second magnitude representative of the randomness of the second set of data values, comparing the first magnitude and the second magnitude, and interrupting the process if the second magnitude exceeds the first magnitude by a given threshold value.