Virtual File Decoy for Ransomware Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing systems are vulnerable to zero-day attacks from crypto-ransomware and other malware, as anti-virus software lacks signatures for new hostile processes and behavior detection-based solutions often fail to prevent file encryption before detection, leading to data loss and resource-intensive decryption efforts.

Innovation Solution

A file system filter driver presents a virtual file to processes, identifying and alerting on attempts to modify it as a hostile process, thereby preventing data encryption and locking down affected folders without creating additional resource burdens.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If behavior detection-based solutions are used to identify suspicious process activity, then detection capability is improved, but files are already encrypted by the time detection occurs

Engineering Contradiction:

Improvedetection capabilityVSAvoidtime to prevent encryption

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary actions by creating virtual files in advance within target folders before hostile processes can encrypt actual user files. When a process attempts to access these virtual files, the system detects the hostile behavior proactively before any real data encryption occurs, thus preventing the time loss associated with post-detection response.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system introduces virtual files as intermediary objects between the hostile process and actual user files. These virtual files serve as decoys that intercept and reveal hostile access attempts without compromising real data, allowing detection to occur at the virtual file level before encryption of genuine files begins.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If anti-virus software uses signatures to identify hostile processes, then detection accuracy is improved, but zero-day attacks cannot be detected due to lack of signatures

Engineering Contradiction:

Improvedetection accuracyVSAvoidability to detect new threats

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

Instead of relying on hostile processes to leave detectable signatures or behavioral patterns, the system inverts the approach by placing detectable virtual files in target folders. The detection occurs when hostile processes attempt to access these known virtual files, reversing the traditional detection model from 'detecting the attacker' to 'detecting access to protected targets'.

Inventive Principle:

Principle #13The other way round (Inversion)

3Reliability

If existing security solutions are deployed to protect against ransomware, then security coverage is improved, but system resources are consumed and decryption efforts become resource-intensive

Engineering Contradiction:

Improvesecurity coverageVSAvoidsystem resource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system employs virtual files as disposable, low-cost objects that consume minimal system resources. These virtual files are created in memory rather than requiring persistent storage, and they are discarded after serving their protective function. This approach provides comprehensive security coverage without the heavy resource consumption associated with traditional decryption efforts.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

Data Source

PatentUS10122752B1Detecting and preventing crypto-ransomware attacks against data

Publication Date: 2018.11.06 VMWARE INC

AI summary

Embodiments perform detection and prevention of unauthorized access to files in a target folder. A filter driver, interfacing with a target folder, intercepts a first request from a process to access a file in the target folder. The filter driver returns a virtual file, along with the existing files, to the process. Upon receiving a second request from the process to write to the virtual file, the filter driver designates the process as a hostile process and prevents further access attempts.