Virtual File Object for Ransomware Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for preventing unauthorized file modification, such as ransomware, are inadequate as they rely on detection methods that can be evaded by malicious software, and approaches like backing up files before modification can lead to performance issues and are ineffective against full disk encryption or deletion.
Innovation Solution
A system and method that generate a virtual file object associated with protected files, redirecting write requests to the virtual file object instead of the protected file, allowing the original files to remain intact and enabling users to revert unwanted changes without the need for backups, thus preventing unauthorized file modification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If files are backed up before modification, then file recovery capability is improved, but disk activity and performance overhead increase significantly
Solution Approach 1:
The patent creates a virtual copy of the file in memory rather than a physical backup on disk. When ransomware attempts to modify the file, the virtual copy contains the previous version, enabling recovery without actual disk I/O operations for backup creation.
Solution Approach 2:
The patent introduces a virtual file object as an intermediary between the original file and the ransomware modification process. This virtual layer intercepts write operations and preserves the original file intact while providing access to the modified version through the virtual object, eliminating the need for physical backup files.
2Reliability
If write access is blocked to unknown programs, then ransomware protection is improved, but user convenience and application functionality deteriorate
Solution Approach 1:
The patent uses a virtual file object as an intermediary that sits between the file system and user applications. This intermediary provides a unified access point that appears to applications as a normal file, but actually protects the original file by intercepting and blocking ransomware write operations while allowing legitimate read operations to proceed normally.
Solution Approach 2:
The patent replaces the mechanical approach of blocking write access at the file system level with a virtualization approach where a virtual copy handles all write operations. This substitution allows the original file to remain untouched while providing the same protection, eliminating the need for restrictive access controls.
3Reliability
If detection methods are used to protect against ransomware, then known ransomware can be blocked, but undetected ransomware and evasive variants cannot be prevented
Solution Approach 1:
The patent applies preliminary anti-action by creating a virtual copy of the file before any modification occurs. This virtual copy serves as a pre-prepared recovery point that is automatically activated when ransomware attempts to modify the original file, preventing the harmful effect regardless of whether the ransomware is detected or evasive.
Solution Approach 2:
The patent creates a virtual copy that mirrors the original file's state and intercepts all write operations. This copy mechanism provides universal protection against all ransomware variants including undetected and evasive ones, as it operates at the virtual layer rather than relying on detection algorithms that can be bypassed.
Data Source
AI summary
A computer implemented cyber security method for preventing and removing undesired modifications of a protected file may include: generating a virtual file object via an authorized handler associated with the protected file, and when a write request to the protected file is received, the write request is redirected to the virtual file object causing the write request to store the change to the data of the protected file as data in the virtual file object; determining if there is data on the virtual file object associated with the protected file; and determining if the data on the virtual file object comprises a change to the data of the protected file; and, committing the change stored on the virtual file object to the data of the protected file after a commit event has been triggered and/or returning the data of the protected file unchanged by the write request in response to the read request, if a revert event was triggered.