Ransomware Mitigation via Entropy Monitoring and File Versioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security solutions fail to effectively protect files from being encrypted and lost due to ransomware, as they often cannot detect or block unknown ransomware or ransomware using legitimate encryption tools, leading to irreversible file damage.
Innovation Solution
A communication system that employs an access control list and behavioral heuristics to monitor and block unauthorized modifications of critical files, using entropy measurements and bait files to detect suspicious activities, and maintains version history for potential file restoration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security solutions are used to protect files from ransomware, then basic malware detection is provided, but the system fails to detect or block unknown ransomware and ransomware using legitimate encryption tools, leading to file encryption and loss
Solution Approach 1:
The system performs preliminary actions by maintaining version history of files before ransomware can encrypt them. The backup service continuously creates and stores previous versions of files, so when ransomware attacks, the original unencrypted versions are already preserved and can be restored immediately, preventing the harmful effect of file loss.
Solution Approach 2:
The system introduces an intermediary mechanism - the backup service that sits between the file system and ransomware. This intermediary monitors file changes, maintains version history, and can restore files to previous states, thereby mediating the interaction between ransomware and critical files to prevent complete encryption.
2Reliability
If access control lists and behavioral heuristics are implemented to monitor and block unauthorized modifications, then detection and blocking of ransomware activities is improved, but system complexity increases
Solution Approach 1:
The system segments the security function into distinct components: an access control list module that manages permissions, a behavioral heuristic module that monitors patterns, and a backup service that handles restoration. This segmentation allows each component to perform its specific function independently, making the overall complex security system more manageable and maintainable.
Solution Approach 2:
The backup service performs multiple functions: it maintains version history, enables file restoration, and works in conjunction with access control lists and behavioral heuristics. This multi-functionality consolidates several security needs into a single service, reducing the number of separate complex components needed.
Data Source
AI summary
Particular embodiments described herein provide for an electronic device that can be configured to allow for the mitigation of ransomware. For example, the system can determine that an application begins to execute, determine that the application attempts to modify a file, determine a file type for the file, and create a security event if the application is not authorized to modify the file type. In another example, the system determines an entropy value between the file and the attempted modification of the file, and create a security event if the entropy value satisfies a threshold or determine a system entropy value that includes a rate at which other files on the system are being modified by the application, and create a security event if the system entropy value satisfies a threshold.