Ransomware Detection via Kernel-Mode File Snapshotting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current ransomware detection techniques fail to prevent initial attacks, leading to data inaccessibility and potential loss, as they rely on post-modification detection methods that cannot protect the first affected file, resulting in negative consequences such as data loss or ransom payment.
Innovation Solution
A ransomware detection and mitigation system that includes a software module with monitoring agents and analysis agents installed on network devices, capable of intercepting suspicious processes, analyzing file modifications, and restoring affected data to a previous state by copying protected files to remote storage before encryption occurs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If post-modification detection techniques are used to analyze victimized systems, then malware identification capability is improved, but protection of the first affected file is lost
Solution Approach 1:
The system performs preliminary actions by monitoring file access attempts and creating snapshots of files before ransomware encryption occurs. The monitoring agent detects suspicious processes and intercepts file access attempts prior to modification, allowing protective measures to be taken in advance rather than after damage occurs.
Solution Approach 2:
The system introduces an intermediary mechanism through the monitoring agent and snapshot storage that sits between the ransomware process and the victim files. This intermediary intercepts encryption attempts, creates protective copies of files before encryption, and enables restoration without direct confrontation with the malicious software.
2Measurement precision
If signature-based detection is used to scan for malware, then detection accuracy is improved, but response time to protect data increases
Solution Approach 1:
The system performs preliminary monitoring and snapshot creation before encryption occurs. By continuously monitoring file access patterns and creating snapshots in advance, the system eliminates the need to wait for signature-based detection to identify malware, thereby reducing response time while maintaining accuracy.
Solution Approach 2:
The monitoring agent operates continuously, maintaining constant surveillance of file system activities. This continuous monitoring ensures that the system is always ready to intercept encryption attempts immediately upon detection, eliminating delays associated with periodic scanning or post-modification analysis.
3Loss of information
If current detection systems analyze victimized networks to identify malware, then malware characterization is improved, but prevention of initial attack is lost
Solution Approach 1:
The system performs preliminary characterization of potential malware through monitoring of process behaviors and file access patterns before actual encryption occurs. By analyzing suspicious processes in advance and creating snapshots of affected files, the system maintains the ability to characterize malware while preventing the initial harmful action.
Solution Approach 2:
The monitoring agent acts as an intermediary that observes and characterizes suspicious processes without allowing them to execute harmful actions. This intermediary captures behavioral data and file access patterns for analysis while intercepting encryption attempts, thereby maintaining characterization capability while preventing initial damage.
Data Source
AI summary
A computerized method for detecting and mitigating a ransomware attack is described. The method features (i) a kernel mode agent that intercepts an initiation of a process, intercepts one or more system calls made by the process when the process is determined to be suspicious and copies at least a portion of a protected file to a secure storage location when a request to open a protected file by the process is intercepted when the process is determined to be suspicious, and (ii) a user mode agent that determines whether the process is a suspicious process, monitors processing of the suspicious process and determines whether the suspicious process is associated with a ransomware attack. Additionally, in order to mitigate effects of a ransomware attack, the kernel mode agent may restore the protected file with a copy stored in the secure storage location when a ransomware attack is detected.