Granted Patent B2

US 12,572,655 · App. 18/599,003 · Granted Mar 10, 2026

Inventors: Roman Alexander Pletka (Uster, CH); Slavisa Sarafijanovic (Adliswil, CH); Dionysios Diamantopoulos (Zurich, CH); Charalampos Pozidis (Thalwil, CH); Yves Alexandre Beraldo Dos Santos (Houston, TX); Andrew D. Walls (San Jose, CA)

Assignee: International Business Machines Corporation

G06F21/565H04L63/1416H04L63/1491

Abstract

Claims (77)

1 . A computer-implemented method (CIM) for detecting ransomware activity in storage systems, comprising:

receiving a write request having a plurality of sectors, wherein each of the sectors includes a number of sub-sectors;

causing the sub-sectors in the respective sectors of the write request to be performed;

determining degrees of randomness across the sub-sectors of the respective sectors by:

determining entropy values associated with the performing the sub-sectors in the respective sectors of the write request, and

determining a difference between the entropy values of the sub-sectors in the respective sectors;

determining whether any deviations exist in the degrees of randomness; and

in response to determining a deviation exists in the degrees of randomness, using information associated with the deviation to determine that one or more of the sub-sectors in one or more of the respective sectors includes data encrypted by ransomware.

2 . The CIM of claim 1 , wherein the determining of the difference between the entropy values of the sub-sectors in the respective sectors includes:

calculating a median absolute deviation (MAD) value for the entropy values of the sub-sectors.

3 . The CIM of claim 2 , further comprising:

aggregating MAD values calculated for write requests over a time interval, wherein the MAD values are aggregated in a histogram.

4 . The CIM of claim 1 , wherein the determining of the entropy values associated with performing the sub-sectors in the respective sectors includes:

calculating a first value, the first value being selected from the group consisting of: a Shannon entropy value, a Chi-Square value, a Monte-Carlo value, and a Pi value; and

using the first value to derive the entropy value.

5 . The CIM of claim 1 , wherein the write request includes a read-modify-write operation, wherein the determining of the degrees of randomness across the sub-sectors includes, for the respective sectors:

reading original data stored in memory at target addresses that correspond to the sub-sectors of a given sector of the write request;

in response to the write request being initiated, evaluating new data in a write cache;

determining entropy values associated with performing the respective sub-sectors in the given sector by comparing the original data and the new data; and

determining a difference between the entropy values of the sub-sectors in the given sector.

6 . The CIM of claim 5 , further comprising:

determining whether any of the target addresses include at least a portion of a known honeypot file; and

in response to determining that one or more of the target addresses include at least a portion of the known honeypot file, identifying the given sector of the write request as including ransomware activity.

7 . The CIM of claim 1 , further comprising:

receiving a second write request which impacts less than a full sector, the second write request having a first set of sub-sectors in an identified sector; and

determining a second set of sub-sectors in the identified sector not being part of the second write request;

reading original data stored in memory at target addresses that correspond to the first and second sets of sub-sectors;

determining a degree of randomness across the first set of sub-sectors in the identified sector; and

determining a degree of randomness across the second set of sub-sectors in the identified sector.

8 . The CIM of claim 1 , wherein the determining of the degrees of randomness across the sub-sectors of the respective sectors includes, determining a number of degrees of randomness across the sub-sectors of a given one of the respective sectors, wherein each degree of randomness is determined using a different combination of sub-sector sizes and/or groupings of sub-sectors of the given sector, wherein the determining of whether any deviations exist in the degrees of randomness is based at least in part on the number of degrees of randomness that are determined.

9 . A computer program product (CPP) for detecting ransomware activity in storage systems, comprising:

a set of one or more computer-readable storage media; and

program instructions, collectively stored in the set of one or more storage media, for causing a processor set to perform the following computer operations:

receive a write request having a plurality of sectors, wherein each of the sectors includes a number of sub-sectors;

cause the sub-sectors in the respective sectors of the write request to be performed;

determine degrees of randomness across the sub-sectors of the respective sectors by:

determining entropy values associated with the performing the sub-sectors in the respective sectors of the write request, and

determining a difference between the entropy values of the sub-sectors in the respective sectors;

determine whether any deviations exist in the degrees of randomness; and

in response to determining a deviation exists in the degrees of randomness, using information associated with the deviation to determine that one or more of the sub-sectors in one or more of the respective sectors includes data encrypted by ransomware.

10 . The CPP of claim 9 , wherein the determining of the difference between the entropy values of the sub-sectors in the respective sectors includes:

calculating a median absolute deviation (MAD) value for the entropy values of the sub-sectors.

11 . The CPP of claim 10 , wherein the program instructions are for causing the processor set to further perform the following computer operations:

aggregate MAD values calculated for write requests over a time interval, wherein the MAD values are aggregated in a histogram.

12 . The CPP of claim 9 , wherein the determining of the entropy values associated with performing the sub-sectors in the respective sectors includes:

calculating a first value, the first value being selected from the group consisting of: a Shannon entropy value, a Chi-Square value, a Monte-Carlo value, and a Pi value; and

using the first value to derive the entropy value.

13 . The CPP of claim 9 , wherein the write request includes a read-modify-write operation, wherein the determining of the degrees of randomness across the sub-sectors includes, for the respective sectors:

reading original data stored in memory at target addresses that correspond to the sub-sectors of a given sector of the write request;

in response to the write request being initiated, evaluating new data in a write cache;

determining entropy values associated with performing the respective sub-sectors in the given sector by comparing the original data and the new data; and

determining a difference between the entropy values of the sub-sectors in the given sector.

14 . The CPP of claim 13 , wherein the program instructions are for causing the processor set to further perform the following computer operations:

determine whether any of the target addresses include at least a portion of a known honeypot file; and

in response to determining that one or more of the target addresses include at least a portion of the known honeypot file, identify the given sector of the write request as including ransomware activity.

15 . The CPP of claim 9 , wherein the program instructions are for causing the processor set to further perform the following computer operations:

receive a second write request which impacts less than a full sector, the second write request having a first set of sub-sectors in an identified sector; and

determine a second set of sub-sectors in the identified sector not being part of the second write request;

read original data stored in memory at target addresses that correspond to the first and second sets of sub-sectors;

determine a degree of randomness across the first set of sub-sectors in the identified sector; and

determine a degree of randomness across the second set of sub-sectors in the identified sector.

16 . A computer system (CS), comprising:

a processor set;

a set of one or more computer-readable storage media;

program instructions, collectively stored in the set of one or more storage media, for causing the processor set to perform the following computer operations:

receive a write request having a plurality of sectors, wherein each of the sectors includes a number of sub-sectors;

cause the sub-sectors in the respective sectors of the write request to be performed;

determine degrees of randomness across the sub-sectors of the respective sectors by:

determining entropy values associated with the performing the sub-sectors in the respective sectors of the write request, and

determining a difference between the entropy values of the sub-sectors in the respective sectors;

determine whether any deviations exist in the degrees of randomness; and

in response to determining a deviation exists in the degrees of randomness, using information associated with the deviation to determine that one or more of the sub-sectors in one or more of the respective sectors includes data encrypted by ransomware.

17 . The CS of claim 16 , wherein the write request includes a read-modify-write operation, wherein the determining of the degrees of randomness across the sub-sectors includes, for the respective sectors:

reading original data stored in memory at target addresses that correspond to the sub-sectors of a given sector of the write request;

in response to the write request being initiated, evaluating new data in a write cache;

determining entropy values associated with performing the respective sub-sectors in the given sector by comparing the original data and the new data; and

determining a difference between the entropy values of the sub-sectors in the given sector.

Assignments (1)

Continuity (1)

References Cited (22)