Behavior-Based Ransomware Detection via Thread Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ransomware is difficult to detect and remediate due to its ability to encrypt files, hide its source, and use existing device processes and threads to obfuscate its presence, leading to high difficulty in detection and potential for multiple attacks if not properly protected.
Innovation Solution
A behavior-based detection method that monitors threads on a computing device for predefined ransomware behaviors, generates a score based on past and new indicators, and terminates the thread if the score exceeds a threshold, utilizing a scoring system and remediation module to quickly identify and eliminate ransomware with low false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If ransomware uses existing device processes and threads to hide, then detection difficulty increases, but system resource utilization is improved
Solution Approach 1:
The patent implements a scoring system that continuously monitors thread behaviors and provides feedback by accumulating scores for detected ransomware indicators. When the score exceeds a threshold, the system triggers remediation. This feedback mechanism enables dynamic detection that adapts to obfuscation techniques while maintaining system resource efficiency.
Solution Approach 2:
The patent introduces an intermediary scoring system that mediates between the monitored thread behaviors and the final detection decision. Instead of directly detecting ransomware based on single indicators, the system uses multiple indicators with associated scores that collectively determine whether remediation is needed, effectively bridging the gap between obfuscation and detection.
2Strength
If ransomware encrypts files with military grade encryption, then data protection capability is improved, but detectability and remediation ease worsen
Solution Approach 1:
The patent performs preliminary detection and remediation actions before ransomware completes its encryption process. By monitoring for ransomware behaviors and terminating suspicious threads when the score threshold is exceeded, the system prevents encryption from occurring in the first place, making remediation unnecessary and effectively bypassing the encryption strength issue.
Solution Approach 2:
The system applies preliminary anti-action by detecting and terminating ransomware threads before they can execute their encryption payload. The scoring system accumulates evidence of malicious behavior and takes countermeasures in advance, neutralizing the threat before it can manifest as encrypted files.
3Measurement precision
If behavior monitoring and scoring system are implemented, then ransomware detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent changes parameters by assigning different score values to different ransomware indicators and using a threshold parameter to determine when remediation should occur. This parametric approach allows the system to maintain high detection accuracy while managing complexity through configurable parameters rather than hard-coded detection logic.
Solution Approach 2:
The scoring system serves multiple functions: it detects ransomware, ranks suspicious activities by severity, and triggers remediation decisions. This multi-functionality reduces overall system complexity by consolidating multiple detection and response mechanisms into a single universal scoring framework.
Data Source
AI summary
An anti-malware application detects, stops, and quarantines ransomware. The anti-malware application monitors threads executing on a computing device and detects behaviors that conform to a predefined set of behaviors indicative of ransomware. Responsive to detecting these behaviors, indicators are stored to a log in a storage device. Each of the indicators in the log is associated with respective scores. A running score for each thread is generated by combining the respective scores of the indicators in the log. Responsive to determining that the running score exceeds a predefined threshold score, execution of the thread is terminated. The source ransomware file is then identified and quarantined.