Ransomware Host Identification Through Storage Write Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing ransomware attack detection methods are reactive and slow, leading to extended downtime and significant data loss, and they do not effectively identify the source of the attack.
Innovation Solution
A technique that identifies blocks written to a data object between two points in time, determines attributes of these blocks, and secures the data object's state if ransomware is likely, combined with identifying the host suspected of initiating the attack by analyzing write requests during a tracking interval.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If detailed analysis of backups is performed to identify clean backups prior to attack, then data recovery can be achieved, but host downtime is extended and data loss increases
Solution Approach 1:
The system performs preliminary actions by continuously monitoring write requests and analyzing block attributes (entropy, compression ratio, sequentiality) during normal operations. When ransomware characteristics are detected, the system proactively secures a clean backup state before the attack completes, rather than reacting after damage occurs. This preliminary detection and secure-backup mechanism reduces both downtime and data loss.
2Speed
If continuous monitoring of all write requests is performed to detect ransomware attributes, then attack detection speed improves, but system complexity and processing overhead increase
Solution Approach 1:
The system applies local quality by focusing monitoring resources specifically on blocks that exhibit ransomware characteristics rather than uniformly analyzing all data. Attributes such as high entropy, poor compression ratios, and sequential write patterns serve as local indicators that trigger further investigation. This targeted approach improves detection speed while reducing overall system complexity by avoiding blanket monitoring of all write operations.
3Loss of substance
If the data storage system secures the state of a data object by creating a backup, then data loss is minimized, but storage resources are consumed
Solution Approach 1:
The system performs preliminary securing of data object states by creating targeted backups only when ransomware attributes are detected in write requests. Rather than continuously backing up all data, the system monitors block attributes (entropy, compression, sequentiality patterns) and triggers secure state preservation only when suspicious patterns indicate an ongoing attack. This approach minimizes data loss while consuming storage resources only when necessary.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A technique of identifying hosts suspected of being sources of ransomware infection includes initiating a tracking interval in response to a data storage system detecting a suspected ransomware attack. During the tracking interval, write requests received by the data storage system are analyzed and ransomware attributes for those write requests are generated. The ransomware attributes of the write requests indicate risks of ransomware infection and are associated with hosts from which the respective write requests originate. A particular host is identified as a suspected source of ransomware infection based at least in part on the ransomware attributes associated with that host.