Ransomware Detection via I/O Activity Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies lack effective methods for automated detection and management of ransomware attacks, particularly in identifying suspicious I/O activity and preventing data pruning during potential attacks.
Innovation Solution
A software module running on client machines monitors I/O activity, records file modifications, creations, deletions, and renames, and compares these actions against a threshold to detect potential ransomware attacks. Additionally, a data agent manages backup and pruning operations, pausing data pruning during detected threats and enabling intelligent restore operations using timestamps.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If data pruning operations are performed to manage data growth, then storage efficiency is improved, but data loss risk increases during ransomware attacks
Solution Approach 1:
The system performs preliminary actions by creating multiple backup copies of data before pruning operations. The backup system captures data states at different time points and maintains these copies in advance, so that when ransomware attacks occur, there are pre-prepared restoration points available without needing to perform urgent backup operations during the attack.
Solution Approach 2:
The system changes the parameter of data retention by maintaining multiple versions of data with different retention periods. It implements a tiered backup strategy where critical data is retained longer and pruning operations are applied selectively based on data importance, allowing storage efficiency improvement while protecting critical data from being pruned during attacks.
2Measurement precision
If I/O monitoring is implemented to detect ransomware, then detection capability is improved, but system performance degradation occurs
Solution Approach 1:
The system extracts the monitoring function into a separate, dedicated module that operates independently from the main data processing operations. This allows I/O monitoring to be performed without interfering with normal system performance, as the monitoring overhead is isolated and does not compete for resources with critical business operations.
Solution Approach 2:
The monitoring system uses self-service techniques by leveraging existing file system metadata and event logs that are already being generated by the operating system. Instead of adding heavy monitoring overhead, the system taps into already-available information sources, thereby achieving detection capability without significant performance degradation.
3Loss of time
If automated ransomware detection is implemented, then response time is improved, but false positive rate increases
Solution Approach 1:
The system implements feedback mechanisms where detection results are continuously analyzed and used to adjust monitoring thresholds. When false positives occur, the system learns from these events and refines its detection criteria, creating a self-improving detection system that maintains fast response times while reducing false alarm rates over time through iterative optimization.
Data Source
AI summary
This application relates to ransomware detection and data pruning management. Ransomware typically involves an I/O heavy process of encrypting data files and/or deleting or renaming the original files. Thus, ransomware attacks may be detected by analyzing the I/O activity in a given file system. In some embodiments, a software module running on a client machine manages copying, archiving, migrating, and/or replicating of primary data and restoring and/or pruning secondary data (e.g., backup copies of the primary data). When a potential ransomware attack is detected, the software module is immediately stopped so that the software module does not prune any data that may need to be restored. Upon receiving user input that indicates that the client machine is not under a ransomware attack, the software module is allowed to resume its operations, including pruning of the secondary data.