Ransomware Detection via Virtual Copy Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ransomware attacks pose a significant threat by encrypting data, making it inaccessible, and existing methods struggle to effectively prevent or reverse these attacks, especially as they evolve and spread across various devices and storage types.
Innovation Solution
A data processing method that utilizes a processor to analyze data characteristics such as bit position ratio, segment bit number ratio, and segment pattern frequency, determining if a ransomware attack has occurred before storing data, thereby preventing encrypted data from being stored and protecting it from malicious encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If ransomware encrypts data to make it inaccessible, then the attacker gains control and demands ransom, but the victim loses access to their data and system functionality
Solution Approach 1:
The patent applies preliminary action by creating encrypted virtual copies of files before the actual ransomware attack occurs. The system pre-encrypts files in a virtual environment and stores these encrypted copies in secure storage, so that if ransomware attacks the real files, the encrypted virtual copies can be used for restoration without paying the ransom.
Solution Approach 2:
The patent changes the encryption parameter state by using different encryption keys for virtual copies versus real files. The system encrypts virtual file copies with first encryption keys and stores them in encrypted form, while real files use different encryption keys. This parameter change allows the system to protect against ransomware that targets specific encryption schemes.
2Measurement precision
If traditional ransomware detection methods are used, then the system can identify known ransomware signatures, but it fails to detect evolving and unknown ransomware variants
Solution Approach 1:
The system performs preliminary encryption of virtual file copies before ransomware attacks occur. By pre-processing files in a virtual environment and storing encrypted versions, the system creates a baseline that can be compared against actual attacked files, enabling detection of ransomware activity even from unknown variants through anomaly detection rather than signature matching.
Solution Approach 2:
The patent creates virtual copies of files and encrypts them in advance. These encrypted virtual copies serve as reference patterns that can be compared with files affected by ransomware attacks. The copying mechanism allows the system to detect ransomware behavior through pattern matching against the pre-created encrypted reference data, improving detection of both known and unknown variants.
3Speed
If the system stores all data in memory for processing, then access speed is fast, but ransomware can easily encrypt and corrupt the stored data
Solution Approach 1:
The patent segments data into virtual copies stored in secure encrypted storage and real files stored separately. By dividing the data storage into multiple segments with different protection levels and encryption schemes, the system allows fast access to unencrypted virtual copies while protecting real files from ransomware encryption attacks.
Solution Approach 2:
The system introduces an intermediary layer of encrypted virtual file copies that act as a buffer between the fast memory access system and the vulnerable real file storage. This intermediary allows the system to maintain fast access speeds by operating on virtual copies while protecting real data from direct ransomware attacks through the isolation provided by the virtualization layer.
Data Source
AI summary
The present disclosure provides a data processing method for coping with ransomware, which encrypts data with a malicious intent and blocks an access to the data, to protect the data, and a program for executing the data processing method. In a computer apparatus that loads an application program stored in a memory onto a processor and carries out a predetermined processing according to the application program, on an operating system (OS) kernel which controls an access of the application program to hardware components of the computer apparatus, the processor reads the data stored in the memory, performs the predetermined processing at the request of the application program, determines whether a ransomware attack occurred for the data before storing the processed data back to the memory, and stores the processed data to the memory according to a determination result, thereby preventing the damage caused by the ransomware attack.