Storage Write Randomness Analysis for Ransomware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems struggle to effectively detect ransomware attacks in data storage systems as they often encrypt and rewrite only parts of files, making detection difficult due to the mixture with legitimate operations.
Innovation Solution
A computer-implemented method that analyzes the degree of randomness across sectors of write requests to identify deviations, using machine learning models to detect ransomware activity by recognizing unnatural shifts in data modification patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional systems monitor write requests for ransomware detection, then security detection capability is improved, but detection accuracy deteriorates due to mixture with legitimate operations
Solution Approach 1:
The patent segments write requests into individual sectors and further divides each sector into sub-sectors. By analyzing randomness at the sub-sector level rather than treating entire sectors as uniform units, the system can identify localized ransomware encryption patterns that differ from legitimate operations, thereby improving detection accuracy while maintaining monitoring capability.
2Productivity
If ransomware encrypts only parts of files, then ransomware effectiveness is improved, but detection difficulty increases
Solution Approach 1:
The patent applies local quality analysis by examining randomness characteristics at the sub-sector level within sectors. Ransomware encryption creates distinct randomness patterns in specific sub-sectors that differ from the surrounding unencrypted or legitimately modified sub-sectors. This localized analysis enables detection of partial file encryption without requiring monitoring of entire files, thus addressing the detection difficulty while allowing ransomware to maintain its partial encryption effectiveness.
Data Source
AI summary
A computer-implemented method, according to one approach, is for detecting ransomware activity in storage systems. The computer-implemented method includes: receiving a write request having a plurality of sectors, and each of the sectors further includes a number of sub-sectors. A degree of randomness is determined across the sub-sectors of each of the respective sectors, and a determination is made as to whether any deviations exist in the degrees of randomness. In response to determining a deviation exists in the degrees of randomness, this information on the deviation is used as an indicator of the write request including ransomware activity.