Virtual Canary Files for Ransomware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for detecting and preventing ransomware attacks face challenges in early detection without losing customer data, polluting the file system, or consuming storage space, particularly in dynamically changing the location, size, attributes, and contents of fake documents to evade malware detection.
Innovation Solution
A computer agent is implemented with a kernel mode layered file system driver that creates virtual canary files, which appear as normal files but do not reside on disk. These virtual canary files are spread across the file system to detect and prevent malicious attacks without consuming storage space or polluting the file system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If physical canary files are created on storage device with hidden attributes, then early detection of ransomware attacks is enabled, but storage space is consumed and file system is polluted
Solution Approach 1:
The patent creates virtual canary files that are copies or representations of real files, stored in memory rather than on disk. These virtual canary files mimic the appearance and structure of actual files to lure ransomware, but consume no physical storage space since they exist only as in-memory data structures.
Solution Approach 2:
The patent introduces a virtual file system layer that acts as an intermediary between the real file system and ransomware. This virtual layer presents canary files to malicious software, preventing direct interaction with real files and isolating the contamination risk.
2Reliability
If physical canary files are created on storage device, then ransomware detection is enabled, but file system is polluted and cleanup becomes problematic
Solution Approach 1:
Virtual canary files are created as in-memory copies rather than physical files on disk. When detection occurs or the system shuts down, these virtual files simply cease to exist in memory without requiring any cleanup operations, eliminating the pollution problem entirely.
Solution Approach 2:
The virtual canary files are designed to be temporary, existing only in memory during system operation. They are automatically discarded when no longer needed or when the system terminates, making them disposable objects that leave no trace on the persistent file system.
3Reliability
If canary files are placed among real documents, then early detection of unauthorized access is enabled, but detection by malware becomes easier
Solution Approach 1:
The virtual file system layer acts as an intermediary that presents canary files to malware while preventing the malware from detecting their virtual nature. The layer intercepts and monitors access attempts, making the canary files appear indistinguishable from real files to malicious software.
Solution Approach 2:
Instead of hiding the virtual nature of canary files, the patent inverts the approach by making them appear completely real to malware while maintaining their virtual identity internally. The monitoring and detection capabilities work by observing interactions with these files that appear authentic but are actually virtual constructs.
4Ease of operation
If canary files are made visible to authenticated users, then user access is maintained, but ransomware can also access and encrypt them
Solution Approach 1:
The virtual file system layer serves as an intermediary that monitors all access to canary files. When ransomware attempts to access or encrypt these files, the layer detects the malicious behavior patterns and blocks the operation, while still allowing legitimate user access to proceed normally.
Solution Approach 2:
The system implements feedback mechanisms where access patterns to canary files are monitored and analyzed. When anomalous behavior indicative of ransomware is detected, the system responds by blocking further access, creating a feedback loop that protects canary files while maintaining normal user operations.
Data Source
AI summary
Provided is a computer agent and method to detect and prevent ransomware attacks early without losing customer data, without polluting the customer's file system or consuming any space on a storage device. The computer agent installs a kernel mode layered file system driver which is attached to encryption level group of a filter manager. With this layered file system filter driver design, it creates virtual canary files in directories which appear like normal files to any user or application though these files will not reside on disk. These virtual canary files are spread as baits across the file system to detect and prevent any malicious attack from any process or application. So that the Virtual Canary Files do not consume a large amount of memory, internal structures representing Virtual Canary Files are placed in virtual memory, but actual contents of the Virtual Canary Files do not reside in virtual memory. Other embodiments disclosed.