Virtual File Honeypots for Injected-Thread Ransomware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems fail to effectively identify malicious threads injected into trusted processes, particularly in the context of ransomware attacks, and do not efficiently manage system resources.
Innovation Solution
The implementation of virtual file honeypots (VFHs) that are generated on-demand and tailored to specific system environments, using machine learning to detect and respond to injected threads, without adding to system overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional file honeypots are used to detect malware, then malware detection capability is improved, but the system cannot detect injected threads within trusted processes
Solution Approach 1:
The patent segments the detection approach by creating separate virtual file honeypots specifically for detecting injected threads within trusted processes, rather than relying on traditional file honeypots that only detect independent malicious processes. This segmentation allows the system to address the specific challenge of thread injection while maintaining overall malware detection capability.
Solution Approach 2:
The patent introduces virtual file honeypots as an intermediary mechanism between the trusted process and potential malware injections. These virtual honeypots act as mediators that intercept and detect malicious threads attempting to inject into trusted processes, enabling the system to identify injected malware without compromising the integrity of the trusted process.
2Measurement precision
If virtual file honeypots are generated for every suspicious thread, then detection accuracy is improved, but system overhead and storage consumption increase
Solution Approach 1:
The patent implements dynamic generation of virtual file honeypots only when suspicious threads are detected, rather than maintaining static honeypot structures continuously. This dynamic approach allows the system to create virtual file honeypots on-demand based on actual threat detection needs, reducing unnecessary storage consumption while maintaining high detection accuracy when needed.
Solution Approach 2:
The patent changes the state of file honeypots from static pre-configured structures to dynamic virtual structures generated only when required. By parameterizing the creation of virtual file honeypots based on detection needs, the system adjusts storage allocation dynamically, creating virtual honeypots only when suspicious activity is detected, thus reducing overall storage consumption while maintaining detection accuracy.
3Reliability
If backup operations include virtual file honeypots, then completeness of backup is improved, but system resources are wasted
Solution Approach 1:
The patent extracts virtual file honeypots from the backup process by designating them as non-persistent, dynamically generated structures that should not be included in backup operations. This extraction allows the system to maintain backup completeness for actual data while excluding the resource-consuming virtual honeypot structures, thereby reducing system resource waste.
Solution Approach 2:
The patent treats virtual file honeypots as disposable, short-living objects that are created only when needed and discarded afterward, rather than treating them as permanent backupable structures. This approach allows the system to generate virtual file honeypots on-demand for detection purposes without attempting to backup them, saving significant system resources that would otherwise be wasted on backing up these temporary structures.
Data Source
AI summary
Systems and methods for ransomware protection in advanced injection-based attacks. The call stack(s) of injected threads are analyzed and a preliminary verdict of benign or malicious can be determined. Additional sensors collect data to associate injected threads with other activities or actors to further estimate the injected thread being benign or malicious. If the threat level is high enough, such as over a given threshold, the preliminary verdict can be determined to be malicious. Subsequently, one or more virtual honeypots are generated for the suspicious threads and the injected thread's response to the virtual honeypots included in anti-ransomware heuristic analysis.