MimosaFTL: Adding Secure and Practical Ransomware Defense Strategy to Flash Translation Layer
MimosaFTL: Adding Secure and Practical Ransomware Defense Strategy to Flash Translation Layer
复制标题
DOI：
10.1145/3292006.3300041
复制
发表时间：
2019-03
期刊：
影响因子：
--
通讯作者：
Peiying Wang;Shijie Jia;Bo Chen-;Luning Xia;Peng Liu
中科院分区：
文献类型：
--
作者：
Peiying Wang;Shijie Jia;Bo Chen-;Luning Xia;Peng Liu
由于加密货币的突然繁荣，如今勒索软件攻击已经普遍存在。但是，大多数现有的勒索软件防御策略都容易受到特权勒索软件的影响，这些勒索软件可以损害操作系统，因此在本地存储的任何备份数据。第一次，闪存存储的过时日期和隔离性质使设计防御策略是可能的，该防御策略可抵制特权勒索软件。在这项工作中，我们提出了MimoSaftl，这是一种安全且实用的勒索软件防御策略，用于配备闪存作为外部存储的移动计算设备。 MimoSaftl通过利用闪存存储的独特特征来抵抗特权恶意软件。此外，对现实世界部署的更实际（与先前的工作相比）通过：1）合并一种可以准确检测勒索软件的细粒检测方案； 2）允许受害人有效地将受感染的外部存储恢复到恶意软件开始腐败时的确切点。实验评估表明，MimoSAFTL可以有效地减轻勒索软件攻击，对I/O性能和闪存存储的寿命产生小小的负面影响。
Ransomware attacks have become prevalent nowadays due to sudden flourish of cryptocurrencies. Most existing defense strategies for ransomware, however, are vulnerable to privileged ransomware who can compromise the operating system and hence any backup data stored locally. The out-of-place-update and the isolation nature of flash memory storage, for the first time, makes it possible to design a defense strategy which is secure against the privileged ransomware. In this work, we propose MimosaFTL, a secure and practical ransomware defense strategy for mobile computing devices equipped with flash memory as external storage. MimosaFTL is secure against the privileged malware by taking advantage of unique characteristics of flash storage. In addition, it is more practical (compared to prior work) for real-world deployments by: 1) incorporating a fine-grained detection scheme which can detect presence of ransomware accurately; and 2) allowing the victim to efficiently restore the infected external storage to the exact point when the malware starts to perform corruption. Experimental evaluation shows that, MimosaFTL can mitigate ransomware attacks effectively with a small negative impact on both I/O performance and lifetime of flash storage.