Storage System Unauthorized Encryption Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ransomware attacks are difficult to detect as they encrypt data, making it challenging to distinguish between authorized and unauthorized encryption, and traditional detection techniques consume significant processing resources.
Innovation Solution
The implementation of unauthorized encryption detection instructions in a storage system that intercept write requests from a designated requester and determine if the data matches a specified pattern, indicating unauthorized encryption if it does not match.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional ransomware detection techniques analyze I/O operations or create snapshot copies to detect encrypted data, then detection capability is improved, but processing resources are significantly consumed and I/O operations are slowed down
Solution Approach 1:
The patent extracts the ransomware detection function from the host system and relocates it to the storage system. The storage system independently analyzes write requests for encryption patterns without requiring the host to perform resource-intensive analysis, thereby improving detection capability while minimizing impact on host processing resources and I/O performance
Solution Approach 2:
The storage system acts as an intermediary between the host and the actual data storage. It intercepts write requests, analyzes them for ransomware indicators using pattern matching, and only then processes the data normally. This intermediary position enables detection without requiring the host to consume additional processing resources
2Measurement precision
If the storage system intercepts and analyzes all write requests for pattern matching, then unauthorized encryption detection accuracy is improved, but processing time and resource consumption increase
Solution Approach 1:
The storage system performs partial analysis by focusing only on the data portion of write requests and using efficient pattern matching techniques. Rather than performing exhaustive analysis on every byte, it applies targeted pattern recognition to detect encryption indicators, achieving high detection accuracy while minimizing processing overhead and time loss
Data Source
AI summary
In some examples, a storage system intercepts a write request communicated over a network from a requester in a host system, the write request to write data of a data volume. The storage system determines whether the data of the write request matches a specified pattern. In response to determining that the data of the write request does not match the specified pattern, the storage system indicates that the write request from the requester in the host system has been corrupted by malware that has performed an unauthorized encryption on the data.