Kernel-Mode Filter Driver for Ransomware File Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ransomware poses a significant threat as security software may not detect it early enough to prevent data loss, and existing preventive measures like backups are not foolproof, especially against encrypting variants that can encrypt network backups.
Innovation Solution
A method and system that scans file operation requests to detect guarded operations, delays their execution, and temporarily stores file copies in a backup storage to prevent data loss without relying on redundant storage, using kernel-mode filter drivers and API call hooking to identify and classify potentially malicious processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional backup methods are used to protect against ransomware, then data can be restored after encryption, but the backup storage itself can be encrypted by the ransomware if connected to the infected computer
Solution Approach 1:
The patent introduces an intermediary component - a filter driver positioned between the ransomware and the backup storage. This filter driver monitors and controls access to backup files, allowing legitimate backup operations while blocking ransomware encryption attempts. The intermediary enables safe backup without requiring physical isolation, resolving the contradiction between backup reliability and backup storage protection.
2Reliability
If security software scans for ransomware payloads, then known threats can be detected, but new ransomware variants can still encrypt files before detection
Solution Approach 1:
The patent implements preliminary action by creating backup copies of files before ransomware encryption occurs. The filter driver proactively monitors file access patterns and creates protective backups in advance, so that when new ransomware variants encrypt files, the original copies are already preserved. This eliminates the time delay associated with detecting and responding to new threats.
3Reliability
If the system monitors and delays file operations to detect ransomware, then encryption can be prevented, but normal file operations may be interrupted
Solution Approach 1:
The patent applies local quality by differentiating between normal file operations and suspicious ransomware behavior. The filter driver analyzes specific characteristics of file access patterns - such as rapid sequential encryption of multiple files - and only applies delays or blocks when ransomware behavior is detected. Legitimate file operations proceed without interruption, maintaining productivity while preventing encryption.
4Loss of information
If ransomware encryption is allowed to complete before detection, then the full scope of damage is known, but data loss has already occurred
Solution Approach 1:
The patent implements feedback by continuously monitoring file operation patterns and comparing them against known ransomware behavior signatures. When suspicious patterns are detected - such as rapid file encryption or unusual access sequences - the system immediately responds by blocking operations and preserving backup copies. This real-time feedback loop prevents data loss before it occurs, rather than detecting it after encryption completes.
Data Source
AI summary
A method for processing files as a preemptive measure against a ransomware activity. The method comprises scanning a plurality of file operation requests sent to an operating system (OS) executed on a computing device to detect a guarded file operation request that comprises instructions to process a file managed by a file system used by said OS, delaying an execution of said guarded file operation request, temporarily storing a copy of said file in a backup storage in response to said detection of said guarded file operation request, and stop delaying said execution of said guarded file operation request when said copy is stored in said backup storage.