A Survey on Detection Techniques for Cryptographic Ransomware <s> B. RECOVERY FROM BACKUPS <s> Preventive and reactive security measures can only partially mitigate the damage caused by modern ransomware attacks. Indeed, the remarkable amount of illicit profit and the cyber-criminals' increasing interest in ransomware schemes suggest that a fair number of users are actually paying the ransoms. Unfortunately, pure-detection approaches (e.g., based on analysis sandboxes or pipelines) are not sufficient nowadays, because often we do not have the luxury of being able to isolate a sample to analyze, and when this happens it is already too late for several users! We believe that a forward-looking solution is to equip modern operating systems with practical self-healing capabilities against this serious threat. Towards such a vision, we propose ShieldFS, an add-on driver that makes the Windows native filesystem immune to ransomware attacks. For each running process, ShieldFS dynamically toggles a protection layer that acts as a copy-on-write mechanism, according to the outcome of its detection component. Internally, ShieldFS monitors the low-level filesystem activity to update a set of adaptive models that profile the system activity over time. Whenever one or more processes violate these models, their operations are deemed malicious and the side effects on the filesystem are transparently rolled back. We designed ShieldFS after an analysis of billions of low-level, I/O filesystem requests generated by thousands of benign applications, which we collected from clean machines in use by real users for about one month. This is the first measurement on the filesystem activity of a large set of benign applications in real working conditions. We evaluated ShieldFS in real-world working conditions on real, personal machines, against samples from state of the art ransomware families. ShieldFS was able to detect the malicious activity at runtime and transparently recover all the original files. Although the models can be tuned to fit various filesystem usage profiles, our results show that our initial tuning yields high accuracy even on unseen samples and variants. <s> BIB001 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. RECOVERY FROM BACKUPS <s> Ransomware is one of the rising malwares in the crimeware family. It encrypts the user files and demands extortion money. From the perspective of an enterprise it is very crucial to detect and stop a ransomware attack. A well studied technique is to monitor file system behavior for suspicious activity. In this work we will show the gap in the existing state of art and describe a dynamic system which learns new behavior while under attack. <s> BIB002 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. RECOVERY FROM BACKUPS <s> Encryption ransomware is a malicious software that stealthily encrypts user files and demands a ransom to provide access to these files. Several prior studies have developed systems to detect ransomware by monitoring the activities that typically occur during a ransomware attack. Unfortunately, by the time the ransomware is detected, some files already undergo encryption and the user is still required to pay a ransom to access those files. Furthermore, ransomware variants can obtain kernel privilege, which allows them to terminate software-based defense systems, such as anti-virus. While periodic backups have been explored as a means to mitigate ransomware, such backups incur storage overheads and are still vulnerable as ransomware can obtain kernel privilege to stop or destroy backups. Ideally, we would like to defend against ransomware without relying on software-based solutions and without incurring the storage overheads of backups. To that end, this paper proposes FlashGuard, a ransomware tolerant Solid State Drive (SSD) which has a firmware-level recovery system that allows quick and effective recovery from encryption ransomware without relying on explicit backups. FlashGuard leverages the observation that the existing SSD already performs out-of-place writes in order to mitigate the long erase latency of flash memories. Therefore, when a page is updated or deleted, the older copy of that page is anyway present in the SSD. FlashGuard slightly modifies the garbage collection mechanism of the SSD to retain the copies of the data encrypted by ransomware and ensure effective data recovery. Our experiments with 1,447 manually labeled ransomware samples show that FlashGuard can efficiently restore files encrypted by ransomware. In addition, we demonstrate that FlashGuard has a negligible impact on the performance and lifetime of the SSD. <s> BIB003 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. RECOVERY FROM BACKUPS <s> Ransomware is a form of extortion-based attack that locks the victim’s digital resources and requests money to release them. The recent resurgence of high-profile ransomware attacks, particularly in critical sectors such as the health care industry, has highlighted the pressing need for effective defenses. While users are always advised to have a reliable backup strategy, the growing number of paying victims in recent years suggests that an endpoint defense that is able to stop and recover from ransomware’s destructive behavior is needed. <s> BIB004 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. RECOVERY FROM BACKUPS <s> The growing popularity of Android and the increasing amount of sensitive data stored in mobile devices have lead to the dissemination of Android ransomware. Ransomware is a class of malware that makes data inaccessible by blocking access to the device or, more frequently, by encrypting the data; to recover the data, the user has to pay a ransom to the attacker. A solution for this problem is to backup the data. Although backup tools are available for Android, these tools may be compromised or blocked by the ransomware itself. This paper presents the design and implementation of RANSOMSAFEDROID, a TrustZone based backup service for mobile devices. RANSOMSAFEDROID is protected from malware by leveraging the ARM TrustZone extension and running in the secure world. It does backup of files periodically to a secure local persistent partition and pushes these backups to external storage to protect them from ransomware. Initially, RANSOMSAFEDROID does a full backup of the device filesystem, then it does incremental backups that save the changes since the last backup. As a proof-of-concept, we implemented a RANSOMSAFEDROID prototype and provide a performance evaluation using an i.MX53 development board. <s> BIB005 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. RECOVERY FROM BACKUPS <s> It is vital to protect the files and data for institutions, organizations and individuals. For this, people and institutions develop methods to provide both physical and digital security, and they spend thousands of dollars over the years for measures. Ransomware is undoubtedly one of the most frequently encountered malicious software that harms people and organizations. These viruses are used to encrypt all important data on the infected computer. Ransomware usually targets file types such as PDF, Word, Excel that can store important documents, bills, financial data, and makes these documents inaccessible by encrypting them. The restoration of these encrypted files is only possible with the keyword in the hand of the person who wrote the virus. This key word is given by an aggressive fee, which means ransom against documents. These fees are usually very high and there is no guarantee that the attacker will not want more fee. In this paper, it is aimed to find solutions to these problems and to minimize possible harm. In order to do so, an area called safezone has been created and prevented from being replaced by other software by moving important documents to this zone. <s> BIB006 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. RECOVERY FROM BACKUPS <s> The threats of destructive ransomware keep increasing and current security facilities (firewall, IDS/IPS, etc.) and backup systems cannot effectively protect data from the attacks in real time. In this paper, we propose a secure container-based backup mechanism to survive destructive ransomware attacks. In the mechanism, the backup process takes place in a highly restricted local docker container and only the container can access both source and backup data stored in the local and remote storages. That is, the host is only allowed to access the source data and the container is only allowed to perform backup process without any other communications. Consequently, any other processes in the host cannot access the backup data stored in the container and the remote storage. Thus even if the host and the container are completely destroyed, the data can be recovered from the remote storage. We implemented a prototype system and confirmed that it can backup data with high usability and store the backup data securely. <s> BIB007
Without an effective ransomware detection mechanism, most enterprises resort to recovery from backups when they suffer a ransomware attack. These backups usually do not contain the last version of files; therefore, some data are always lost. They also suffer the effect of work disruption during file recovery. Using the special writing behaviour in an SSD, a better backup policy can be implemented. In FlashGuard BIB003 , Huang et al. took advantage of how SSDs perform out-ofplace write operations instead of replacing the old data with the new content of a file. SSDs behave in this manner because they must erase the data content before they write to those memory cells, and the erase operation is time consuming. Since the SSD does not erase the original data but writes to a different memory cell, these data can be recovered if they are read before they are erased by the SSD garbage collector. However, this procedure does not offer the detection of ransomware action. Paik et al.  used a very similar approach, but added ransomware detection based on the read/rewrite patterns. Some proposals for ransomware detection require observing the process of file encryption, and raise an alarm only when some files have been lost. This procedure can be improved by keeping a backup of the files being edited at the cost of a higher disk response time to applications because any file modification operation is intercepted to maintain a backup. Continella et al. BIB001 created a copy of a file before allowing the requesting process to modify it. If the process was classified as ransomware, it was halted and the files it modified were recovered from the copied documents, which were the most recent versions before encryption. Following a similar procedure, in BIB004 the monitoring software redirected every write request to a sparse file in a protected area without changing the original file. In BIB002 the read/write operations were redirected only in cases of suspicious file system activity. Storage systems based on objects instead of files can make objects immutable, turning write operations into the creation of a new version of the object. Eze et al. described in  the use of secure object storage to recover encrypted objects. Both Baykara and Sekin BIB006 and Jin et al. BIB007 described backup solutions against ransomware attacks. They created periodic copies of protected files in either a compressed file BIB006 or inside a docker container BIB007 , adding the possibility of an extra backup to a remote file server. A similar proposal was presented in BIB005 for an Android operating system. These proposals are similar to some recent commercial offerings of backup solutions targeting ransomware threats. Most solutions offer no significant difference to a usual backup and only expose how a backup policy can solve or alleviate the problems that result from a ransomware infection  . However, products like  , [81], [103] combine the detection of ransomware action with the recovery mechanisms of backup files.