SSD-Assisted Ransomware Detection and Data Recovery Techniques
- 주제(키워드) Ransomware , malware detection , data recovery , flash-based SSDs
- 주제(기타) Computer Science, Hardware & Architecture; Engineering, Electrical & Electronic
- 설명문(일반) [Baek, Sungha] Inha Univ, Incheon 22212, South Korea; [Jung, Youngdon; Lee, Sungjin] Daegu Institue Sci & Technol, Dept Informat & Commun Engn, Daegu 42988, South Korea; [Mohaisen, David] Univ Cent Florida, 4328 Scorpius St, Orlando, FL 32816 USA; [Nyang, Daehun] Ewha Womans Univ, Cyber Secur Dept, 52 Ewhayeodae Gil, Seoul 03760, South Korea
- 관리정보기술 faculty
- 등재 SCIE, SCOPUS
- 발행기관 IEEE COMPUTER SOC
- 발행년도 2021
- 세부유형 Article
- URI http://www.dcollection.net/handler/ewha/000000183526
- 본문언어 영어
- Published As http://dx.doi.org/10.1109/TC.2020.3011214
초록/요약
As ransomware attacks have been prevalent, it becomes crucial to make anti-ransomware solutions that defend against ransomwares. In this article, we propose a new ransomware defense system, called SSD-Insider++, which prevents users' files from being damaged by ransomware attacks. SSD-Insider++ is embedded into an SSD controller as a form of firmware. By being separated from a host machine, it not only provides more robust data protection than software-based ones which are vulnerable to evasion attacks, but also offers interoperability with various platforms. SSD-Insider++ is composed of two novel features, ransomware detection and perfect data recovery, which are tightly integrated with each other. The detection algorithm observes I/O patterns of a host system and decides whether the host is being attacked by ransomwares in an early stage. Once an encryption attack is detected, the recovery algorithm is triggered to recover original files by leveraging a delayed deletion feature of an SSD at a low cost. Our experimental results show that SSD-Insider++ achieves high accuracy of detecting ransomwares with 0 percent FRR/FAR in most cases and provides an instant data recovery with 0 percent data loss. The overhead of running SSD-Insider++ is negligible - only 80 ns and 226 ns are spent more for handling 4-KB reads and writes, respectively.
more