Unauthorized Access Detection Device for Ransomware Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting ransomware, such as signature-based detection, are ineffective in real-time and fail to protect files from encryption by unknown ransomware variants, as they rely on observed malware signatures and do not provide immediate protection.
Innovation Solution
An unauthorized access detection device that monitors input/output request packets (IRPs) for file access, using AI models to identify abnormal access patterns and data trends, blocking unauthorized file modifications by determining the randomness of data to be written, thereby preventing ransomware encryption in real-time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection is used to detect malware, then detection accuracy for known malware is improved, but detection capability for unknown ransomware variants deteriorates
Solution Approach 1:
The patent changes the detection parameters from static malware signatures to dynamic behavioral parameters including file access frequency, data write volume, entropy changes, and access patterns. This allows the system to detect unknown ransomware variants by monitoring how files are accessed and modified rather than relying on predefined signatures, thereby improving adaptability while maintaining detection accuracy through multi-parameter analysis
2Adaptability or versatility
If backup data is used for ransomware detection, then detection of unknown ransomware is improved, but real-time protection deteriorates
Solution Approach 1:
The patent implements preliminary action by establishing baseline file access patterns and entropy values before ransomware infection occurs. The system continuously monitors file system operations in real-time, comparing current operations against established baselines to detect anomalies immediately. This allows real-time detection without waiting for backup data analysis, as the detection mechanism is proactively in place and operational before any infection occurs
Solution Approach 2:
The system implements continuous feedback loops where file access operations are monitored in real-time, compared against baseline patterns, and immediately flagged when anomalies are detected. The feedback mechanism provides instant alerts and can trigger automated responses such as process termination or isolation, enabling real-time protection while maintaining the ability to detect unknown variants through pattern deviation analysis
3Measurement precision
If comprehensive file analysis is performed to detect ransomware, then detection accuracy is improved, but processing time and data usage increase
Solution Approach 1:
The patent extracts only the most critical and indicative parameters from file operations, such as entropy changes, access frequency, data write volume, and file type transitions. By focusing on these key indicators rather than analyzing every aspect of file operations comprehensively, the system maintains high detection accuracy while significantly reducing processing time and computational resource requirements
Solution Approach 2:
The system applies partial action by performing lightweight monitoring on all file operations and conducting more intensive analysis only on suspicious operations that deviate from baseline patterns. This tiered approach allows the system to process large volumes of file operations efficiently while maintaining high detection accuracy for actual ransomware activities, avoiding the overhead of comprehensive analysis on every operation
Data Source
AI summary
An unauthorized access detection device that includes a control device for executing: abnormal access request detection processing in which a plurality of pieces of input/output request data for accessing a file is acquired and it is determined whether or not an access mode to the file is abnormal on the basis of patterns of the acquired plurality of pieces of input/output request data; abnormal data detection processing in which, where it is determined that the access mode to the file is abnormal, it is determined, by specifying data to be written into the file on the basis of the acquired input/output request data and specifying a trend of the specified data, whether or not the specified data is abnormal data; and suspicious process resolution processing in which, where it is determined that the specified data is abnormal data, predetermined processing related to access to the file is executed.