Seamlessly Safeguarding Data Against Ransomware Attacks

Elkhail, Abdulrahman Abu; Lachtar, Nada; Ibdah, Duha; Aslam, Rustam; Khan, Hamza; Bacha, Anys; Malik, Hafiz

doi:10.1109/tdsc.2022.3214781

Cited by 10 publications

(12 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…While our current implementation does not include file recovery, we stress that on average Minerva detects ransomware in 1.002sec, with 99.97% of the ransomware activity being detected in one second or less. These detection times align with the page cache delay time used in [12], which means that this approach can be implemented in our system with similarly low overhead.…”

Section: Minerva Architecturesupporting

confidence: 61%

“…In particular, it is assumed that the Disk Activity Monitor module, the File-Based Behavioral Detector module, and the File Recovery module can work correctly and independently of any ransomware infecting the system. These assumptions are in line with prior work in the field [6,12,18,21]. The details of each module are described in Section 4.1.…”

Section: Threat Modelmentioning

confidence: 77%

“…We position ourselves in a threat model similar to those considered by prior work in the domain [6,12,18,21]: the adversary is a ransomware that has infected a target machine with the goal of encrypting users files and ask for a ransom to recover the data. Specifically, we consider different types of ransomware attacks according to their capabilities and behaviors:…”

Section: Threat Modelmentioning

confidence: 99%

“…Previous work shows that if ransomware is detected quickly, the File Recovery module can be implemented with essentially zero overhead through the operating system's page cache. In [12], the authors implement a similar file protection mechanism that delays the operating system's page cache flushing for suspicious processes to prevent ransomware operations on disk. The authors show that as long as the time required to detect ransomware is low enough, the delay on cache flushing has minimal impact on the system performance (< 2%).…”

Section: Minerva Architecturementioning

confidence: 99%

“…Should ransomware manage to penetrate network defense, a number of detection algorithms can be used to identify ransomware activity at the process level, terminate the unwanted processes, and restore encrypted files to their original content. Most existing approaches [6,12,18,21] generate and analyze process-level features to distinguish ransomware processes performing file encryption from other benign processes executing on the machine. They effectively build behavioral profiles of benign and ransomware applications and compare all processes in a system against these profiles to classify them.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Minerva: A File-Based Ransomware Detector

Hitaj¹,

Pagnotta²,

Gaspari³

et al. 2023

Preprint

View full text Add to dashboard Cite

Ransomware is a rapidly evolving type of malware designed to encrypt user files on a device, making them inaccessible in order to exact a ransom. Ransomware attacks resulted in billions of dollars in damages in recent years and are expected to cause hundreds of billions more in the next decade. With current state-of-the-art process-based detectors being heavily susceptible to evasion attacks, no comprehensive solution to this problem is available today. This paper presents Minerva, a new approach to ransomware detection. Unlike current methods focused on identifying ransomware based on process-level behavioral modeling, Minerva detects ransomware by building behavioral profiles of files based on all the operations they receive in a time window. Minerva addresses some of the critical challenges associated with process-based approaches, specifically their vulnerability to complex evasion attacks. Our evaluation of Minerva demonstrates its effectiveness in detecting ransomware attacks, including those that are able to bypass existing defenses. Our results show that Minerva identifies ransomware activity with an average accuracy of 99.45% and an average recall of 99.66%, with 99.97% of ransomware detected within 1 second.

show abstract

Section: Minerva Architecturesupporting

confidence: 61%

Section: Threat Modelmentioning

confidence: 77%