Virtual File Objects for Ransomware Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity measures are inadequate in preventing unauthorized file modifications, particularly from malicious software like ransomware, as they often rely on detection methods that can be evaded and cause performance overhead or fail to protect against full disk encryption or deletion.
Innovation Solution
A computer-implemented method that generates virtual file objects to store modifications separately, allowing original files to remain intact and revert unwanted changes, without requiring backups, thus preventing unauthorized file modifications while maintaining low disk usage and performance impact.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If files are backed up to another location on the disk before modification, then file recovery is enabled after ransomware detection, but disk I/O activity doubles causing significant performance degradation
Solution Approach 1:
The patent segments the file modification process by creating a virtual copy (virtual file object) of the original file. This virtual copy stores the modified data while the original file remains intact on the disk. The segmentation separates the protection mechanism from the original file system operations, allowing modifications to be tracked without duplicating disk I/O activity for backup purposes.
Solution Approach 2:
The patent introduces a virtual file object as an intermediary between the ransomware modification process and the original file. This intermediary captures modification instructions and stores them in a virtual structure that can be reverted from, without requiring traditional backup copying. The virtual file object acts as a mediator that records changes in memory rather than requiring physical disk backup operations.
2Reliability
If traditional backup methods are used to protect against ransomware, then file recovery is possible, but the solution fails against full disk encryption or disk wiping attacks
Solution Approach 1:
The patent performs preliminary action by creating virtual file objects that capture modification instructions before ransomware can execute destructive actions. The system proactively intercepts file modification requests and creates virtual representations of these changes, allowing recovery even before the ransomware completes its encryption or wiping process. This preliminary capture of modification states enables restoration from any point in the attack sequence.
Solution Approach 2:
The patent implements beforehand cushioning by maintaining virtual file objects that serve as a protective buffer against ransomware attacks. These virtual objects contain the modification instructions and can be used to revert changes, providing a cushioning effect that protects the original file system from permanent damage. The virtual file structure acts as a safety net that absorbs the impact of malicious modifications.
3Reliability
If write access is blocked to unknown programs, then ransomware is blocked from encrypting files, but legitimate third-party applications may not work and users face continuous complaints
Solution Approach 1:
The patent implements self-service by allowing programs to modify files through virtual file objects without requiring administrative approval or blocking. The virtual file system automatically handles the modification process by creating and managing virtual copies, eliminating the need for access control restrictions. Programs can freely write to virtual file objects while the original files remain protected, providing self-service file modification capability without security compromises.
4Productivity
If virtual file objects are generated to store modifications separately, then original files remain intact and performance overhead is reduced, but the system complexity increases
Solution Approach 1:
The patent applies parameter changes by modifying the file system's data structure parameters to include virtual file objects. Instead of changing the fundamental architecture, the system adds virtual file metadata and structure parameters that allow virtual copies to be created and managed. This parameter-based approach enables the virtual file system to operate with minimal architectural changes while maintaining performance efficiency.
Data Source
AI summary
In some embodiments, a cyber security method for preventing unauthorized file modification by malicious software and the like, the file accessible to an authorized handler may include: receiving a first access request from a program, the first access request having a first instruction set for modifying data of the file; determining if the file is associated with the authorized handler; processing the first instruction set to produce first modification data; and generating an initial virtual file object comprising the first modification data. In further embodiments, a cyber security method for preventing unauthorized file modification by malicious software and the like, the file accessible to an authorized handler may include: processing an instruction set for modifying a file to produce modification data; generating a virtual file object comprising the modification data; and associating the virtual file object with the file by identifying the file as a sparse file.