Snapshot Signature Detection for Unauthorized Data Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ransomware attacks are difficult to detect because they often encrypt data over a long period, making it challenging to distinguish between authorized and unauthorized encryption, and can render backups unusable, leading to significant data loss.
Innovation Solution
A protection server is provided with a snapshot of a production server's volume, where an agent generates first signatures for data objects, and the protection server generates second signatures for these objects, comparing them to detect unauthorized encryption by ransomware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If ransomware encrypts data over a long period, then the attack becomes harder to detect, but the data loss increases and recovery becomes more difficult
Solution Approach 1:
The system performs preliminary actions by continuously capturing snapshots of data objects and their cryptographic hashes before ransomware encryption occurs. These pre-computed hashes are stored and ready for immediate comparison when encryption is detected, enabling rapid response before significant data loss occurs.
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring data object hashes against stored baseline hashes. When a hash mismatch is detected, the system immediately generates alerts and can trigger containment actions, creating a closed-loop detection and response system that prevents further encryption.
2Measurement precision
If the system monitors all data objects continuously, then detection accuracy improves, but resource consumption increases
Solution Approach 1:
The system applies local quality by focusing monitoring resources on critical data objects that have been recently modified or accessed. Instead of uniformly monitoring all data, the system prioritizes objects with recent write operations, as these are most likely to be targeted by ransomware, thereby reducing overall resource consumption while maintaining high detection accuracy.
Solution Approach 2:
The system uses partial action by sampling and monitoring only a subset of data objects at any given time, specifically those with recent changes. This partial monitoring approach provides sufficient detection capability without the excessive resource consumption of monitoring every data object continuously, achieving an optimal balance between detection accuracy and resource usage.
3Reliability
If the system stores baseline hashes for all data objects, then detection capability improves, but storage requirements increase
Solution Approach 1:
The system performs preliminary actions by capturing and storing baseline hashes of data objects at specific points in time, particularly after successful backups or during known safe periods. These pre-computed baseline hashes are stored efficiently and can be immediately compared against current data hashes when ransomware activity is suspected, enabling rapid detection without requiring continuous storage of all data.
Solution Approach 2:
The system extracts only the essential information needed for detection - the cryptographic hashes of data objects - rather than storing complete data copies. This extraction approach reduces storage requirements significantly while maintaining full detection capability, as hashes provide sufficient uniqueness identification without requiring storage of the actual data content.
4Speed
If the system performs frequent hash comparisons, then detection speed improves, but processing overhead increases
Solution Approach 1:
The system implements periodic action by performing hash comparisons at specific intervals and triggered events rather than continuously. Hash comparisons are performed periodically during backup operations and when specific threshold conditions are met (such as changes in data access patterns), providing timely detection without the processing overhead of constant monitoring and comparison.
Solution Approach 2:
The system uses self-service mechanisms where data objects themselves trigger monitoring actions through their own operations. When data objects are written to or accessed, they automatically generate hash computations and comparisons without requiring external system intervention, reducing processing overhead while maintaining rapid detection capability through event-driven architecture.
Data Source
AI summary
In some examples, a system provides access, to a first server, a copy of a volume of data associated with a second server, where the first server is protected against unauthorized access. The first server receives first signatures generated by an agent in the second server based on applying a function on data objects of the volume. The first server generates, at the, second signatures derived based on applying the function on data objects of the copy of the volume. The first server determines whether malware that performs unauthorized data encryption of data of the second server is present, based on comparing the second signatures to the first signatures.