Ransomware Detection via Hardware Performance Counters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing ransomware detection methods are ineffective due to the emergence of advanced ransomware variants that employ evasion techniques, leading to high false positives and resource-intensive detection processes, with a lack of protection for the detection module and noise interference.
Innovation Solution
A semi-supervised machine learning system using low-level hardware information, specifically a Lightweight Hardware Anomaly Realtime Detection (HARD-Lite) framework, which employs a recurrent neural network (LSTM) for real-time anomaly detection on a separate classifier machine, offloading computation-intensive tasks from the user machine and utilizing Weighted Majority Voting and Exponential Moving Average to reduce false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional static ransomware detection mechanisms are used, then detection simplicity is maintained, but detection effectiveness deteriorates due to advanced evasion techniques
Solution Approach 1:
The patent replaces traditional static detection mechanisms with a dynamic machine learning-based detection system. The classifier uses semi-supervised learning with temporal aspect modeling to analyze hardware performance counters, substituting mechanical rule-based detection with adaptive computational intelligence that can automatically adapt to new ransomware variants and evasion techniques.
Solution Approach 2:
The system changes detection parameters by using temporal sequences of hardware performance counters instead of static file system metrics. The recurrent neural network models the temporal dynamics of system behavior, allowing detection based on how hardware parameters evolve over time rather than their instantaneous values, thereby improving detection of sophisticated ransomware that attempts to mask its file system activities.
2Reliability
If heavy-weight classification work is performed on the user machine, then detection accuracy can be maintained, but user machine functionality deteriorates due to resource consumption
Solution Approach 1:
The detection system is segmented into two separate components: a lightweight data collection module that runs on the user machine to gather hardware performance counters, and a separate classifier machine that performs the computationally intensive classification work. This segmentation allows the user machine to maintain full functionality while the classification machine handles the heavy processing burden, achieving both detection accuracy and system performance.
Solution Approach 2:
The patent introduces an intermediary architecture where the user machine communicates with a remote classifier machine through standardized interfaces. The classifier machine acts as an intermediary that receives performance counter data, performs complex analysis using semi-supervised learning, and returns detection results, thereby protecting the user machine from resource exhaustion while maintaining detection capabilities.
3Reliability
If the detection module is integrated with the user machine, then protection can be provided, but the detection module itself becomes vulnerable to attack
Solution Approach 1:
The classifier machine serves as a protected intermediary that is physically or virtually separated from the user machine. By locating the detection module on a separate system, the patent eliminates the vulnerability of embedding detection code on potentially compromised user machines. The classifier machine can be maintained in a secure environment with strict access controls, protecting the detection logic from ransomware attacks while still providing protection to user machines.
Data Source
AI summary
A semi-supervised machine learning system and method to detect ransomware using low-level hardware information. Employing semi-supervised learning method on performance counter data for anomaly prediction, the system can detect ransomware in real-time with its online detection process.