GuardFS: a File System for Integrated Detection and Mitigation of Linux-based Ransomware

Jan von der Assen,Chao Feng,Alberto Huertas Celdrán,Róbert Oleš,Gérôme Bovet,Burkhard Stiller

2024-01-31

Abstract:Although ransomware has received broad attention in media and research, this evolving threat vector still poses a systematic threat. Related literature has explored their detection using various approaches leveraging Machine and Deep Learning. While these approaches are effective in detecting malware, they do not answer how to use this intelligence to protect against threats, raising concerns about their applicability in a hostile environment. Solutions that focus on mitigation rarely explore how to prevent and not just alert or halt its execution, especially when considering Linux-based samples. This paper presents GuardFS, a file system-based approach to investigate the integration of detection and mitigation of ransomware. Using a bespoke overlay file system, data is extracted before files are accessed. Models trained on this data are used by three novel defense configurations that obfuscate, delay, or track access to the file system. The experiments on GuardFS test the configurations in a reactive setting. The results demonstrate that although data loss cannot be completely prevented, it can be significantly reduced. Usability and performance analysis demonstrate that the defense effectiveness of the configurations relates to their impact on resource consumption and usability.

Cryptography and Security

What problem does this paper attempt to address?

The paper aims to address the limitations of current ransomware detection systems in real-world defense scenarios, particularly the integrated detection and mitigation solutions on Linux systems. Specifically, although many existing studies have demonstrated high accuracy in detecting ransomware, these methods often fail to effectively translate this detection capability into practical defense measures. Moreover, most solutions primarily focus on data recovery rather than prevention. Therefore, this paper proposes a file system-level framework called GuardFS, designed to integrate ransomware detection and mitigation mechanisms. GuardFS extracts data before files are accessed through a custom overlay file system and uses trained models for classification to identify malicious processes. To mitigate threats, GuardFS designs three different defense configurations: obfuscation, delay, or tracking of file system access. Experimental results show that while it is not possible to completely prevent data loss, the losses can be significantly reduced. Additionally, the framework evaluates the impact of different configurations on resource consumption and usability. Overall, this study attempts to fill the gap in existing research on how to effectively utilize AI-driven detection systems to enhance defense mechanisms in real-world environments.

GuardFS: a File System for Integrated Detection and Mitigation of Linux-based Ransomware

Travelling the Hypervisor and SSD: A Tag-Based Approach Against Crypto Ransomware with Fine-Grained Data Recovery

MTFS: a Moving Target Defense-Enabled File System for Malware Mitigation

Ransomware Detection Using Machine Learning in the Linux Kernel

Fight Malware Like Malware: A New Defense Method Against Crypto Ransomware

Early mitigation of CPU-optimized ransomware using monitoring encryption instructions

RSSD: Defend against Ransomware with Hardware-Isolated Network-Storage Codesign and Post-Attack Analysis

A Comprehensive Analysis of Machine Learning Based File Trap Selection Methods to Detect Crypto Ransomware

Ransomware Detection Using Federated Learning with Imbalanced Datasets

An Empirical Study of Data Disruption by Ransomware Attacks

Crypto-Ransomware and Their Defenses: In-depth Behavioral Characterization, Discussion of Deployability, and New Insights

Federated Learning Approach for Distributed Ransomware Analysis

RansomAI: AI-powered Ransomware for Stealthy Encryption

VaultFS: Write-once Software Support at the File System Level Against Ransomware Attacks

A comprehensive analysis combining structural features for detection of new ransomware families

A Ransomware Classification Framework Based on File-Deletion and File-Encryption Attack Structures

Leveraging eBPF and AI for Ransomware Nose Out

Process based volatile memory forensics for ransomware detection

Retaliation against Ransomware in Cloud-Enabled PureOS System

Software-Defined Networking-based Crypto Ransomware Detection Using HTTP Traffic Characteristics

Ransomware detection based on machine learning using memory features