Virtual File Honeypots for Ransomware Detection in Storage-Constrained Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware and ransomware protection methods for computing systems with limited storage resources, such as Industrial Control Systems and IoT systems, face challenges in efficiently detecting threats without straining system storage capacity and input/output operations.
Innovation Solution
The implementation of virtual file honeypots (VFHs) that are mixed with real files to lure malicious processes, reducing storage footprint as they are not backed up, and allowing for accurate and efficient threat detection without significant storage or I/O overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional file honeypots are used to detect malicious processes, then detection capabilities are enhanced, but storage resources and I/O operations are significantly increased
Solution Approach 1:
The patent creates virtual copies of file honeypots that exist only in memory rather than on physical storage. These virtual honeypots are generated on-demand when a process attempts to access system files, allowing the system to maintain detection capabilities without consuming physical storage resources. The virtual honeypots are instantiated as necessary and destroyed after use, eliminating the need for persistent storage.
Solution Approach 2:
The invention transitions from physical storage-based honeypots to virtual memory-based honeypots. Instead of storing honeypot files on the disk alongside real files, the system uses virtual memory to create and manage honeypot representations. This dimensional shift from physical to virtual space resolves the storage capacity constraint while maintaining the functional integrity of the honeypot mechanism.
2Reliability
If file system filters and volume filters are used to detect suspicious file modifications, then ransomware protection is improved, but system performance degrades due to increased overhead
Solution Approach 1:
The patent extracts the honeypot functionality from the traditional file system filter layer and implements it as a virtual mechanism that intercepts process access attempts. Instead of filtering all file system operations continuously, the system only creates virtual honeypots when specific access patterns indicate potential malware behavior. This extraction reduces the continuous overhead on the file system while maintaining protection effectiveness.
Solution Approach 2:
The system dynamically creates and destroys virtual honeypots based on real-time detection of suspicious access patterns, rather than maintaining static filter drivers that operate continuously. This dynamic approach allows the system to adapt its security behavior to actual threats while minimizing performance impact during normal operation. The virtual honeypots are instantiated only when needed and destroyed after serving their detection purpose.
3Reliability
If traditional file honeypots are mixed with real files on storage devices, then detection effectiveness is improved, but storage overhead increases
Solution Approach 1:
The patent creates virtual copies of honeypot files that exist only in memory rather than on physical storage. These virtual honeypots are generated on-demand when a process attempts to access system files, allowing the system to maintain detection capabilities without consuming physical storage resources. The virtual honeypots are instantiated as necessary and destroyed after use, eliminating the need for persistent storage.
Data Source
AI summary
Virtual file honeypots (VFHs) are deployed to protect real files in a computing system. The storage footprint is reduced because the virtual file honeypots do not require storage resources. VFHs are generated to appear the same as other files in a computing system, presenting an attractive attack surface as bait to reveal malicious processes and agents. The VFHs are generated on-demand and are not backed up in system storage. The use of VFHs requires less storage capacity than real honeypot files and conserves computing system resources.