A Content-Based Ransomware Detection and Backup Solid-State Drive for Ransomware Defense
- Authors
- Min, Donghyun; Ko, Yungwoo; Walker, Ryan; Lee, Junghee; Kim, Youngjae
- Issue Date
- 7월-2022
- Publisher
- IEEE-INST ELECTRICAL ELECTRONICS ENGINEERS INC
- Keywords
- Ransomware; Performance evaluation; Entropy; Encryption; Machine learning; Libraries; Engines; Ransomware attack; solid-state drive (SSD); storage security; storage system
- Citation
- IEEE TRANSACTIONS ON COMPUTER-AIDED DESIGN OF INTEGRATED CIRCUITS AND SYSTEMS, v.41, no.7, pp.2038 - 2051
- Indexed
- SCIE
SCOPUS
- Journal Title
- IEEE TRANSACTIONS ON COMPUTER-AIDED DESIGN OF INTEGRATED CIRCUITS AND SYSTEMS
- Volume
- 41
- Number
- 7
- Start Page
- 2038
- End Page
- 2051
- URI
- https://scholar.korea.ac.kr/handle/2021.sw.korea/142923
- DOI
- 10.1109/TCAD.2021.3099084
- ISSN
- 0278-0070
- Abstract
- Ransomware is a growing concern in business and government because it causes immediate financial damages or loss of important data. There is a way to detect and block ransomware in advance, but evolved ransomware can still attack while avoiding detection. Another alternative is to back up the original data. However, existing backup solutions can be under the control of ransomware and backup copies can be destroyed by ransomware. Moreover, backup methods incur storage and performance overhead. In this article, we propose AMOEBA, a device-level backup solution that does not require additional storage for backup. AMOEBA is armed with: 1) a hardware accelerator to run content-based detection algorithms for ransomware detection at high speed and 2) a fine-grained backup control mechanism to minimize space overhead for data backup. For evaluations, we not only implemented AMOEBA using the Microsoft solid-state drive (SSD) simulator but also prototyped it on the OpenSSD-platform. Our extensive evaluations with real ransomware workloads show that AMOEBA has high ransomware detection accuracy with negligible performance overhead.
- Files in This Item
- There are no files associated with this item.
- Appears in
Collections - School of Cyber Security > Department of Information Security > 1. Journal Articles
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.