Snapshot-Based Anomaly Detection for False Alert Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data management systems struggle to accurately distinguish between malicious and non-malicious activities in computing systems, leading to false positives during anomaly detection, particularly in large-scale changes such as those caused by ransomware attacks or system upgrades.
Innovation Solution
A data management system (DMS) captures snapshots and maintains metadata to identify changes, using thresholds for system-file-count and system-file-byte ratios to differentiate between malicious and non-malicious activities by analyzing file paths and directory names, thereby reducing false alerts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a data management system monitors file changes to detect malicious activities, then the ability to identify ransomware attacks is improved, but false positives increase due to non-malicious activities like system upgrades
Solution Approach 1:
The patent segments the file change monitoring process into multiple analysis dimensions: (1) basic file change detection, (2) file path pattern analysis to identify system files, (3) ratio calculation between system files and total files deleted, and (4) threshold-based classification. This segmentation allows the system to distinguish between malicious and non-malicious activities by examining different aspects of file changes separately and comprehensively.
Solution Approach 2:
The patent introduces quantitative parameters to characterize file changes: the ratio of system files deleted to total files deleted, and the ratio of system file bytes deleted to total bytes deleted. By calculating these parameters and comparing them against predefined thresholds, the system transforms qualitative anomaly detection into quantitative analysis, enabling more accurate discrimination between ransomware attacks and legitimate system operations.
2Reliability
If the system alerts on all large-scale file deletions, then malicious activities are detected, but user experience deteriorates due to excessive false alerts
Solution Approach 1:
The patent employs threshold-based parameter comparison to control alert generation. By calculating the ratio of system files deleted to total files deleted and comparing it against a predefined threshold, the system intelligently determines whether to generate an alert. This parameter-driven approach ensures that alerts are only generated when the pattern matches malicious behavior, eliminating false alerts caused by system upgrades and improving user experience.
Solution Approach 2:
The system implements a feedback mechanism where the analysis results (ratio calculations) feed back into the alert decision process. The calculated ratios are compared against thresholds to determine alert generation, creating a closed-loop system that continuously refines detection accuracy based on observed patterns, thereby reducing false positives while maintaining reliable malicious activity detection.
Data Source
AI summary
Methods, systems, and devices for data management are described. A data system may capture a first snapshot of a target computing system at a first time, and a second snapshot at a second time that is later than the first time. The system may compare the second snapshot with the first snapshot to identify whether a set of deleted files includes a quantity of deleted files that satisfies a file deletion threshold. Using metadata associated with the target computing system, the system may identify a subset of the set of deleted files as corresponding to one or more system files. The DMS may then determine whether a ratio between a first value of a deletion metric and a second value of the deletion metric satisfies a threshold ratio. In some examples, the system may refrain from generating an alert based on the ratios satisfying the threshold ratio.