Cited 1 time in webofscience Cited 2 time in scopus

SSD-Assisted Ransomware Detection and Data Recovery Techniques

Title
SSD-Assisted Ransomware Detection and Data Recovery Techniques
Authors
Baek, SunghaJung, Young DonMohaisen, AzizLee, SungjinNyang, Daehun
DGIST Authors
Baek, Sungha; Jung, Young Don; Mohaisen, Aziz; Lee, Sungjin; Nyang, Daehun
Issue Date
2021-10
Citation
IEEE Transactions on Computers, 70(10), 1762-1776
Type
Article
Article Type
Article in press
Author Keywords
RansomwareMalware DetectionData RecoveryFlash-based SSDs
ISSN
0018-9340
Abstract
As ransomware attacks have been prevalent, it becomes crucial to make anti-ransomware solutions that defend against ransomwares. In this article, we propose a new ransomware defense system, called SSD-Insider++, which prevents users' files from being damaged by ransomware attacks. SSD-Insider++ is embedded into an SSD controller as a form of firmware. By being separated from a host machine, it not only provides more robust data protection than software-based ones which are vulnerable to evasion attacks, but also offers interoperability with various platforms. SSD-Insider++ is composed of two novel features, ransomware detection and perfect data recovery, which are tightly integrated with each other. The detection algorithm observes I/O patterns of a host system and decides whether the host is being attacked by ransomwares in an early stage. Once an encryption attack is detected, the recovery algorithm is triggered to recover original files by leveraging a delayed deletion feature of an SSD at a low cost. Our experimental results show that SSD-Insider++ achieves high accuracy of detecting ransomwares with 0 percent FRR/FAR in most cases and provides an instant data recovery with 0 percent data loss. The overhead of running SSD-Insider++ is negligible - only 80 nns and 226 nns are spent more for handling 4-KB reads and writes, respectively.
URI
http://hdl.handle.net/20.500.11750/12637
DOI
10.1109/tc.2020.3011214
Publisher
Institute of Electrical and Electronics Engineers
Related Researcher
  • Author Lee, Sungjin Data-Intensive Computing Systems Laboratory
  • Research Interests Computer System, System Software, Storage System, Non-volatile Memory, Flash-based SSD, Distributed Storage Systems
Files:
There are no files associated with this item.
Collection:
Department of Information and Communication EngineeringData-Intensive Computing Systems Laboratory1. Journal Articles


qrcode mendeley

Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.

BROWSE