In this paper, a key backup technique for the recovery of files encrypted by ransomware is proposed. Ransomware interferes with the victim's system through abnormal behavior such as locking of the victim's system or encryption of the system or files. Ransomware writers demand money from the victims as a condition for the recovery of the encrypted files and systems that have been seized; systems infected by ransomware cannot be repaired without a decryption key, making the employment of detection and recovery methods urgent. This paper proposes a prevention technique for backing up encryption keys in a secure repository which enables the recovery of ransomware-infected systems and ransomware-encrypted files. The proposed technique can be used to repair systems infected by ransomware, thereby ensuring safety against such malicious codes.
KEYWORDSbig data security, key backup, prevention, ransomware
INTRODUCTIONAs modern society is changing into an information society, various kinds of corresponding information are utilized and stored. In the past, users stored their personal information in storage media such as hard disks, floppy disks, and CDs. While the computing environment and the network environment continually develop, remote storage technologies such as web hard drives and cloud services-wherein data and the computing environment such as software are used remotely-have emerged. With the development of the storage environment, the remote techniques are able to process mass data, and big data has emerged as a result. Big data is the derivation of value of data through the collection, storage, management, and analysis of mass data.Similar to other research fields, the most important element of big data is the data itself. In this respect, the analyzed results are valuable when data must be preserved without the need for alteration; unfortunately, though, there is a problem regarding ensuring the reliability of the data. Because many problems are caused by forged data, a critical issue is the vulnerability of the system data that are stored, and a representative example is cyber-crime. Past cyber-crimes originated from curiosity but have developed into a tool for revenge, monetary purposes, and cyber warfare, and cyber-crime has become a kind of service called "CaaS" (crime as a service). 1 These services are being sold as products and are classified according to consulting services: botnet setups, infection and spreading services, botnet and rentals, and crimeware-upgrade modules. Concretely, a consulting service for a typical botnet setup is approximately 350 to 400 dollars, whereas an infection and spreading service is approximately 100 dollars for every 1000 installed. Therefore, big data systems comprising part of the various service-related data have been exposed to threats, and the salience of this issue is further highlighted by the recent emergence of ransomware. In February 2016, one of the most notorious ransomware attacks occurred; because of this, Hollywood Presbyterian Medical Center in the US was ...