Ransomware Detection Using File Event Statistical Snapshots
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-ransomware solutions are limited to specific ransomware families and fail to protect against new or zero-day variants, lacking flexibility and effectiveness in detecting ransomware-like behavior.
Innovation Solution
A system and method that analyzes file events and generates statistical snapshots to detect ransomware-like behavior by monitoring file systems, utilizing machine learning algorithms to identify suspicious activities, and performing remediation actions such as terminating processes and quarantining files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing anti-ransomware solutions use specific family-based detection methods, then they can detect known ransomware variants, but they fail to protect against new or zero-day variants
Solution Approach 1:
The patent transforms the detection approach from family-specific signature matching to analyzing statistical parameters of file events (creation, modification, deletion patterns). By monitoring parameters like event frequency, timing intervals, and file type distributions, the system detects ransomware behavior regardless of specific variant, enabling both reliable detection of known threats and protection against zero-day variants through anomaly detection in these statistical parameters.
2Reliability
If the system monitors all file events and generates statistical snapshots, then it can detect ransomware-like behavior, but it increases computational complexity and processing overhead
Solution Approach 1:
The system extracts only the essential statistical features from file events that are most indicative of ransomware behavior, such as event frequency, timing patterns, and file type distributions. Rather than analyzing all raw file event data in full detail, the patent selectively monitors and aggregates specific parameters into statistical snapshots, reducing computational complexity while maintaining detection reliability by focusing on the most discriminative features.
3Reliability
If the system performs remediation actions such as terminating processes and quarantining files, then it can mitigate ransomware attacks, but it may interfere with legitimate system operations
Solution Approach 1:
The system implements feedback mechanisms where statistical snapshots are continuously analyzed and compared against established baselines of normal system behavior. Remediation actions are triggered only when statistical patterns deviate significantly from normal operation, allowing the system to adapt to legitimate changes in system usage while maintaining protection against ransomware. This feedback loop enables the system to distinguish between malicious and benign operations, reducing false positives while maintaining protection effectiveness.
Data Source
AI summary
Systems and methods are provided to detect ransomware and ransomware-like behavior.