Server Entropy Analysis for Malicious Encryption Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing detection methods for malicious encryption programs are ineffective in preventing data encryption on network drives, leading to potential data encryption on servers, which can significantly reduce server productivity and is unacceptable in corporate environments.
Innovation Solution
A system and method that intercepts file operation requests from clients on servers, calculates entropies of file portions before and after operations, and compares these entropies to determine if a malicious encryption program is present, allowing or denying operations based on the calculated differences.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If backtracking all file activity on the server is performed to detect malicious encryption programs, then detection accuracy is improved, but server productivity is significantly reduced
Solution Approach 1:
The patent implements preliminary detection by calculating entropy values of files before malicious encryption occurs. The system monitors file entropy changes in real-time, allowing detection of encryption attempts before they complete, thus preventing full backtracking operations that would reduce server productivity.
Solution Approach 2:
The patent replaces the mechanical approach of backtracking all file activity with an information-theoretic approach using entropy calculation. Instead of analyzing every file operation mechanically, the system uses entropy values to detect encryption patterns, reducing computational overhead and maintaining server productivity while achieving accurate detection.
2Measurement precision
If entropy calculation is performed on entire files, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The patent divides files into segments and calculates entropy values for each segment rather than processing entire files at once. This segmentation allows the system to detect encryption patterns in smaller portions, reducing processing time while maintaining detection accuracy through cumulative entropy analysis.
Solution Approach 2:
The patent performs entropy calculation on only the necessary portions of files (partial action) rather than entire files. By calculating entropy on file headers or specific segments where encryption patterns are most detectable, the system achieves accurate detection with reduced processing time.
Data Source
AI summary
A method for detection of malicious encryption programs, the method comprising: intercepting, at a server, a file operation request from a client on a file stored on the server; collecting information about at least the requested file and the requested operation; determining, by a hardware processor of the server, based on the collected information, whether the file operation request came from a known malicious encryption program; when the file operation request came from an unknown program, then calculating, by the hardware processor, entropies of at least a portion of the file before and after the execution of the requested operation on the file; and calculating, by the hardware processor, a difference between the calculated entropies; when the difference is below a threshold, allowing the requested operation on the file; and when the difference is above the threshold, denying the requested operation on the file.