# US 2025/0094579 A1 · Methods and systems for detecting, via resource-level entropy checks, resources having anomalous attributes > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0094579 A1 - Document ID: US20250094579A1 - Status: Published application - Kind: A1 - Application number: 18/888,484 - Filed: 2024-09-18 - Published: 2025-03-20 - Earliest claimed: 2023-09-18 - Assignees: Alcion, Inc. - Applicants: Alcion, Inc. - Inventors: Zachary Rossman; Eno Thereska; Georgi Milkov Matev - Web page: https://patentgrep.com/patent/US20250094579A1 ## CPC - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/554: {involving event detection and direct action} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for detecting, by a ransomware detection system, via at least one resource-level entropy check during a process for transmitting a plurality of resource to a data backup system, a resource in the plurality of resources having an anomalous attribute includes generating, by the ransomware detection system, a first machine learning model associated with a first type of resource associated with at least one resource in the plurality of resources. The ransomware detection system determines that a first resource in the plurality of resources is associated with the first type, the determining occurring prior to transmission of a second resource in the plurality of resources to the data backup system. The ransomware detection system analyzes, using the first machine learning model. The ransomware detection system determines that the first resource is anomalous. The ransomware detection system transmits an alert of the determination that the first resource is anomalous. ## Claims ### Claim 1 A method for detecting, by a ransomware detection system, via at least one resource-level entropy check during a process for transmitting a plurality of resource to a data backup system, a resource in the plurality of resources having an anomalous attribute, the method comprising: (A) generating, by a ransomware detection system, a first machine learning model associated with a first type of resource associated with at least one resource in a plurality of resources transmitted to a data backup system; (B) determining, by the ransomware detection system, that a first resource in the plurality of resources is associated with the first type, the determining occurring prior to transmission of a second resource in the plurality of resources to the data backup system; (C) analyzing, by the ransomware detection system, the first resource, using the first machine learning model, the analyzing occurring prior to transmission of the second resource to the data backup system; (D) determining, by the ransomware detection system, prior to transmission of the second resource in the plurality of resources to the data backup system, based on the analysis, that the first resource is anomalous; and (E) transmitting, by the ransomware detection system, an alert of the determination that the first resource is anomalous. ### Claim 2 (depends on 1) The method of claim 1, wherein (A) further comprises generating the first machine learning model associated with the first type of resource based on a type of user associated with the at least one resource. ### Claim 3 (depends on 1) The method of claim 1, wherein (A) further comprises generating the first machine learning model associated with the first type of resource based on an attribute of the plurality of resources. ### Claim 4 (depends on 1) The method of claim 1, wherein (A) further comprises generating the first machine learning model associated with the first type of resource based on an attribute of a computing device transmitting the plurality of resources to the data backup system. ### Claim 5 (depends on 1) The method of claim 1, wherein (A) further comprises generating, by the ransomware detection system, a second machine learning model associated with a second type of resource associated with at least one resource in the plurality of resources. ### Claim 6 (depends on 5) The method of claim 5, wherein (B) further comprises determining that the first resource is associated with the second type. ### Claim 7 (depends on 6) The method of claim 6, wherein (C) further comprises analyzing, using the second generated machine learning model, the first resource. ### Claim 8 (depends on 1) The method of claim 1, wherein (C) further comprises determining that the anomalous resource includes ransomware. ### Claim 9 (depends on 1) The method of claim 1, wherein (B) further comprises determining that a second resource in the plurality of resources is associated with the first type, the determining occurring prior to transmission of a third resource in the plurality of resources to the data backup system. ### Claim 10 (depends on 9) The method of claim 9, wherein (C) further comprises analyzing, prior to transmission of a third resource in the plurality of resources to the data backup system, using the first machine learning model, the second resource. ### Claim 11 (depends on 10) The method of claim 10, wherein (C) further comprises determining, prior to transmission of the third resource in the plurality of resources to the data backup system, that the first resource and the second resource are associated with a type of anomalous behavior. ### Claim 12 (depends on 1) The method of claim 1, wherein (D) further comprises: generating, by the ransomware detection system, an entropy score associated with the first resource; and determining that the entropy score associated with the first resource exceeds a threshold level of entropy scores. ### Claim 13 A system comprising at least one non-transitory computer-readable medium having computer program instructions stored thereon, the computer program instructions being executable by at least one computer processor to perform a method for detecting, by a ransomware detection system, via at least one resource-level entropy check during a process for transmitting a plurality of resource to a data backup system, a resource in the plurality of resources having an anomalous attribute, the method comprising: (A) generating, by a ransomware detection system, a first machine learning model associated with a first type of resource associated with at least one resource in a plurality of resources transmitted to a data backup system; (B) determining, by the ransomware detection system, that a first resource in the plurality of resources is associated with the first type, the determining occurring prior to transmission of a second resource in the plurality of resources to the data backup system; (C) analyzing, by the ransomware detection system, using the first machine learning model, the analyzing occurring prior to transmission of the second resource to the data backup system; (D) determining, by the ransomware detection system, prior to transmission of the second resource in the plurality of resources to the data backup system, based on the analysis, that the first resource is anomalous; and (E) transmitting, by the ransomware detection system, an alert of the determination that the first resource is anomalous. ### Claim 14 (depends on 13) The system of claim 13, wherein (A) further comprises generating the first machine learning model associated with the first type of resource based on an attribute of a computing device transmitting the plurality of resources to the data backup system. ### Claim 15 (depends on 13) The system of claim 13, wherein (A) further comprises generating, by the ransomware detection system, a second machine learning model associated with a second type of resource associated with at least one resource in the plurality of resources. ### Claim 16 (depends on 15) The system of claim 15, wherein (B) further comprises determining that the first resource is associated with the second type. ### Claim 17 (depends on 16) The system of claim 16, wherein (C) further comprises analyzing, using the second generated machine learning model, the first resource. ### Claim 18 (depends on 13) The system of claim 13, wherein (B) further comprises determining that a second resource in the plurality of resources is associated with the first type, the determining occurring prior to transmission of a third resource in the plurality of resources to the data backup system and wherein (C) further comprises analyzing, prior to transmission of a third resource in the plurality of resources to the data backup system, using the first machine learning model, the second resource ### Claim 19 (depends on 18) The system of claim 18, wherein (D) further comprises determining, prior to transmission of the third resource in the plurality of resources to the data backup system, that the first resource and the second resource are associated with a type of anomalous behavior. ### Claim 20 (depends on 13) The system of claim 13, wherein (D) further comprises: generating, by the ransomware detection system, an entropy score associated with the first resource; and determining that the entropy score associated with the first resource exceeds a threshold level of entropy scores.