Abstract:Ransomware has evolved from an economic nuisance to a national security threat nowadays, which poses a significant risk to users. To address this problem, we propose RansomTag, a tag-based approach against crypto ransomware with fine-grained data recovery. Compared to state-of-the-art SSD-based solutions, RansomTag makes progress in three aspects. First, it decouples the ransomware detection functionality from the firmware of the SSD and integrates it into a lightweight hypervisor of Type I. Thus, it can leverage the powerful computing capability of the host system and the rich context information, which is introspected from the operating system, to achieve accurate detection of ransomware attacks and defense against potential targeted attacks on SSD characteristics. Further, RansomTag is readily deployed onto desktop personal computers due to its parapass-through architecture. Second, RansomTag bridges the semantic gap between the hypervisor and the SSD through the tag-based approach proposed by us. Third, RansomTag is able to keep 100% of the user data overwritten or deleted by ransomware, and restore any single or multiple user files to any versions based on timestamps. To validate our approach, we implement a prototype of RansomTag and collect 3,123 recent ransomware samples to evaluate it. The evaluation results show that our prototype effectively protects user data with minimal scale data backup and acceptable performance overhead. In addition, all the attacked files can be completely restored in fine-grained.

Research on Secure Destruction of Digital Information

Destructive Electronics from Electrochemical-Mechanically Triggered Chemical Dissolution

Disposal of waste computer hard disk drive: data destruction and resources recycling.

Travelling the Hypervisor and SSD: A Tag-Based Approach Against Crypto Ransomware with Fine-Grained Data Recovery

The Research of Information Hiding Technology Based on Portable Executable File Format

Design of self-destruction strategy used in TMR based on multi-level authentication

Investigation of Data Deletion Vulnerabilities in NAND Flash Memory Based Storage

The Theory and Application of File Deleting

Design and Implementation of Self-securing Disk

Vacuum: An Efficient and Assured Deletion Scheme for User Sensitive Data on Mobile Devices

Data Privacy and Integrity Appropriate for Disk Protection

Self-destruct Function in Embedded Fault-Tolerant System Used in Key Fields

Research and Design of Self-securing Disk

An Adaptive Technique using Advanced Encryption Standard to Implement Hard Disk Security

Schemes for Privacy Data Destruction in a NAND Flash Memory

A Provable Key Destruction Scheme Based on Memristive Crossbar Arrays

Ghosts of Deletions Past: New Secure Deletion Challenges and Solutions

Research on Energetic Micro-Self-Destruction Devices with Fast Responses

Implementation of Disk Encrypt and Restore Technology Based on Single File System

PALES: Optimizing secure data deletion in SSDs via page group and reprogram speedup

A Study of Secure Deduplication Systems and Key Technologies