Storage Access Monitoring for Endpoint-Free Ransomware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting ransomware attacks are ineffective against unknown patterns, require endpoint software updates, and fail to prevent data encryption and exfiltration, especially when countermeasures are not fully implemented.
Innovation Solution
A storage access monitoring method that analyzes operation information from storage devices to detect ransomware by comparing current and past behavior patterns, ratios, and statistical trends, providing early detection and prevention of data encryption and exfiltration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virus checking software is used to detect ransomware, then known ransomware patterns can be detected and removed, but unknown ransomware patterns cannot be detected
Solution Approach 1:
The system performs preliminary actions by collecting operation information and establishing baseline behavior patterns before ransomware infection occurs. By pre-configuring normal operation profiles and monitoring thresholds, the system is prepared to detect deviations indicating ransomware activity, enabling early detection without requiring endpoint software or pattern matching
Solution Approach 2:
Instead of detecting ransomware directly through pattern matching at the endpoint, the system inverts the approach by monitoring storage device operations for abnormal patterns that indicate ransomware activity. This indirect detection method identifies encryption behavior through its impact on storage operations rather than through viral signatures
Solution Approach 3:
The storage device serves as an intermediary monitoring point between the ransomware and the data. By placing monitoring at the storage layer, the system can detect ransomware encryption behavior as it manifests in storage operations, providing a neutral observation point that does not require endpoint software
2Reliability
If virus checking software is installed on all endpoints, then detection coverage is improved, but system complexity and maintenance burden increase
Solution Approach 1:
The detection function is extracted from the endpoint devices and relocated to the storage device. This eliminates the need for virus checking software on endpoints while maintaining detection capability, as the storage device independently monitors its own operations for ransomware indicators
Solution Approach 2:
The storage device performs self-monitoring of its operations to detect ransomware activity. By having the storage device analyze its own operation information for abnormal patterns, the system eliminates dependency on external endpoint software while maintaining autonomous detection capability
3Reliability
If backup data is stored in inaccessible Vault area, then data protection from ransomware is improved, but identification of pre-infection backup data becomes time-consuming
Solution Approach 1:
The system implements continuous feedback monitoring of storage operations, tracking encryption-like patterns in real-time. This ongoing monitoring provides immediate alerts when ransomware activity is detected, enabling rapid response before backup recovery becomes necessary and eliminating the need for time-consuming retrospective analysis
Solution Approach 2:
By detecting ransomware activity through operation pattern analysis before encryption completes, the system enables preliminary protective actions such as isolating the infected system or triggering automated backup to known-good states, significantly reducing recovery time compared to post-infection backup verification
4Reliability
If file access log monitoring is implemented, then ransomware detection capability is improved, but system complexity and resource requirements increase
Solution Approach 1:
The monitoring is performed locally at the storage device where the actual encryption operations occur. By analyzing operation information directly at the storage layer rather than collecting and analyzing logs from multiple endpoints, the system reduces complexity while maintaining detection effectiveness
Solution Approach 2:
The system monitors only the critical storage operation patterns that indicate ransomware activity rather than implementing comprehensive endpoint log collection. By focusing on specific encryption-related operation patterns, the system achieves effective detection with minimal complexity and resource requirements
Data Source
AI summary
A storage access monitoring method acquires the operation status of a volume constituting a storage device from which an endpoint (host) can read/write data through a network as operation information, and determines whether or not a behavior related to the latest operation information is abnormal by performing any one or more of a comparative analysis step, a pattern comparison step, or a trend comparison step. The comparative analysis step includes comparing the latest operation information with past operation information. The pattern comparison step includes determining whether or not there is a behavioral pattern that indicates a possibility of an effect of the ransomware in the latest operation information. The trend comparison step includes determining whether or not an operation related to the latest operation information is different from a normal operation related to the past operation information.