Making Honey Files Sweeter: SentryFS -- A Service-Oriented Smart Ransomware Solution
CoRR(2021)
摘要
The spread of ransomware continues to cause devastation and is a major concern for the security community. An often-used technique against this threat is the use of honey (or canary) files, which serve as ``trip wires'' to detect ransomware in its early stages. However, in our analysis of ransomware samples from the wild, we discovered that attackers are well-aware of these traps, and newer variants use several evasive strategies to bypass traditional honey files. Hence, we present the design of SentryFS - a specialized file system that strategically ``sprays'' specially-crafted honey files across the file system. The canaries are generated using Natural Language Processing (NLP) and the content and the metadata is constantly updated to make the canaries appear more attractive for smarter ransomware that is selective in choosing victim files. Furthermore, to assist with the management of the honey files, SentryFS connects with an anti-ransomware web service to download the latest intelligence on novel ransomware strategies to update the canaries. Finally, as a contingency, SentryFS also leverages file clones to prevent processes from writing to files directly in the event a highly stealthy ransomware goes undetected. In this case, the ransomware encrypts the clones rather than the actual files, leaving users' data unmodified. An AI agent then assigns a suspicion score to the write activity so that users can approve/discard the changes. As an early-warning system, the proposed design might help mitigate the problem of ransomware.
更多查看译文
关键词
smart ransomware solution,honey files sweeter,sentryfs,service-oriented
AI 理解论文
溯源树
样例
![](https://originalfileserver.aminer.cn/sys/aminer/pubs/mrt_preview.jpeg)
生成溯源树,研究论文发展脉络
Chat Paper
正在生成论文摘要