Ransomware I/O Fingerprinting for Faster Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current ransomware attack detection methods require significant time to analyze data content, leading to delayed detection and inability to generate timely alarms.
Innovation Solution
Determine a target fingerprint based on an input/output (I/O) sequence, comparing it with attack fingerprints in a library to quickly identify ransomware attacks without analyzing the data content, using features such as instructions and storage addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If data content is calculated and detected to determine ransomware attacks, then detection accuracy is improved, but detection time increases significantly
Solution Approach 1:
The patent extracts only the essential identifying features (fingerprint characteristics) from the complete data content, rather than analyzing the entire data. By taking out only the critical fingerprint elements from the I/O sequences, the system achieves rapid comparison and detection without the time-consuming process of analyzing full data content, thus resolving the contradiction between detection accuracy and detection time.
Solution Approach 2:
The patent creates simplified copies (fingerprints) of the original I/O sequences that capture the essential characteristics needed for ransomware detection. These fingerprint copies contain the critical identifying features but are much smaller and faster to process than the complete data, enabling rapid comparison against known attack patterns while maintaining detection accuracy.
2Reliability
If complete data content is analyzed for ransomware detection, then detection reliability is improved, but productivity decreases
Solution Approach 1:
The system extracts only the critical fingerprint characteristics from complete I/O sequences, obtaining the essential information needed for reliable detection without processing the entire data set. This extraction approach maintains detection reliability by preserving the key identifying features while dramatically improving processing speed and productivity.
Solution Approach 2:
The patent changes the parameter being analyzed from complete data content to condensed fingerprint representations. By transforming the data from its original full-form representation to a compressed fingerprint form that retains the essential detection-critical parameters, the system achieves both high reliability and high productivity.
Data Source
AI summary
An example ransomware attack detection method includes: determining a target fingerprint based on a target input/output (I/O) sequence; determining a similarity between an attack fingerprint in an attack fingerprint library and the target fingerprint based on the attack fingerprint library and the target fingerprint; and determining, based on the similarity between the target fingerprint and the attack fingerprint, that the target I/O sequence is a normal I/O sequence or a ransomware attack I/O sequence.