Server Entropy Analysis for Malicious Encryption Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious data encryption programs are ineffective in preventing data encryption on network drives, which can lead to data encryption on servers, causing significant productivity loss in corporate environments.
Innovation Solution
A system and method that intercepts file operation requests on a server, calculates entropies of file portions before and after operations, and compares these entropies to determine if a malicious encryption program is present, allowing or denying operations based on the difference exceeding a threshold.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If backtracking all file activity on the server is performed to detect malicious encryption, then detection accuracy is improved, but server operational productivity deteriorates significantly
Solution Approach 1:
The system performs preliminary actions by intercepting file operation requests before encryption occurs and calculating entropy values in advance. File system driver filters capture requests at the driver level, and entropy calculations are performed on file contents before malicious encryption modifies them, enabling detection without backtracking through all subsequent file activity
Solution Approach 2:
The system introduces intermediary components including file system driver filters that intercept requests between the application and storage, and entropy calculation mechanisms that analyze file contents without requiring full backtracking of file activity. These intermediaries enable detection while maintaining server productivity
2Reliability
If traditional entropy calculation methods are used to detect encryption malware, then detection capability is improved, but false alarms increase and operational speed decreases
Solution Approach 1:
The system applies local quality by calculating entropy selectively on specific file portions (such as headers or targeted segments) rather than entire files. This localized approach maintains detection capability while significantly reducing computational overhead and improving operational speed
Solution Approach 2:
The system performs partial action by calculating entropy on only the necessary portions of files (e.g., headers or specific segments) rather than complete files. This partial analysis maintains adequate detection capability while reducing computational load and false alarms
3Loss of time
If file operation requests are intercepted and analyzed in real-time, then detection timeliness is improved, but system complexity increases
Solution Approach 1:
The system uses file system driver filters as intermediaries that are already positioned in the file I/O path, enabling real-time interception without adding complex detection infrastructure. The entropy calculation module serves as another intermediary that processes intercepted requests with minimal additional complexity
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed are systems and method for detection of malicious encryption programs. An example method comprises: intercepting, at a server, a file operation request from a client on a file stored on the server; collecting information about at least the requested file and the requested operation; determining, by a hardware processor of the server, based on the collected information, whether the file operation request came from a known malicious encryption program; when the file operation request came from an unknown program, then calculating, by the hardware processor, entropies of at least a portion of the file before and after the execution of the requested operation on the file; and calculating, by the hardware processor, a difference between the calculated entropies; when the difference is below a threshold, allowing the requested operation on the file; and when the difference is above the threshold, denying the requested operation on the file.