EAGER: SaTC: Applying Adversarial Machine Learning Techniques to Recover Deleted Information from Flash Storage

在当前的数据时代，海量数据以前所未有的速度产生。2022年全球创建和使用的数据总量估计为97 ZB，预计到2025年将增长到181 ZB。极大的数据量给数据操作带来了巨大的挑战，尤其是对NAND闪存的删除。由于NAND阵列独特的体系结构，目前的NAND闪存系统无法利用标准的基于重写的擦除技术，而是使用资源光删除操作，如全零擦除，这可能会导致数据泄漏。通过仔细分析存储器位的模拟读取，删除的数据仍然可以部分恢复。解决闪存删除的漏洞需要更深入地了解攻击者如何利用闪存的模拟读取来重建原始删除的信息。为了实现这一目标，本研究研究了敌手如何使用机器学习技术从闪存中恢复删除的信息。该项目的创新之处在于应用机器学习技术来验证从擦除的闪存中重建原始数据的有效性，并评估各种数据类型对对手攻击的敏感度。该项目的更广泛的意义和重要性是：研究成果将导致更可信的数据清理方法，被认为是安全的和擦除后无法恢复的。闪存制造商可以直接从这些发现中受益，并确保其内存清理过程的安全。该项目的直接成果将是培训两名具有网络安全和机器学习研究经验的研究生。通过应用模拟阅读技术将删除的比特分类为强零或弱零，表明闪存中的删除图像可以恢复到可识别的水平。攻击者可以很容易地使用机器学习技术来重建闪存中已删除的信息。重建的可行性受到所使用的检测阈值和数据类型的极大影响，因为它们表现出不同程度和类型的连续性，这可能决定ML模型的成功。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

In the current data era, massive amount of data is generated at an unprecedented speed. The total amount of data created, and used globally in the year 2022 was estimated to be 97 zettabytes and projected to grow to 181 zettabytes by the year 2025. The extremely large data size poses enormous challenges to data operations and in particular to NAND flash memory deletion. Due to the unique architecture of NAND array, current NAND flash storage systems cannot utilize the standard overwrite-based erasure techniques but instead use a resource-light deletion operation, such as all-zero scrubbing, which could become vulnerable for data leakage. The deleted data can still be partially recovered by carefully analyzing the analog reading of the memory bits. Addressing the vulnerability of flash memory deletion requires a deeper understanding on how an adversary could exploit the analog reading of a flash memory to reconstruct the original deleted information. To achieve this goal, this research studies on how an adversary can use machine learning techniques to recover deleted information from flash storage. The project’s novelties are to apply machine learning techniques to validate the efficacy of reconstructing original data from scrubbed flash memory and to evaluate the susceptibility of various data types to adversary attacks. The project's broader significance and importance are: The research findings will led to more trusted data cleaning methods deemed secure and irrecoverable after scrubbing. The flash memory manufacturers can directly benefit from such findings and secure their memory scrubbing processes. A direct outcome of this project will be the training of two graduate students with research experiences in cybersecurity and machine learning.By applying analog reading techniques to classify deleted bits as strong or weak zeros, it was shown that a deleted image in flash memory can be restored to a recognizable level. An adversary can easily use machine learning techniques to reconstruct deleted information from flash memory. The feasibility of reconstruction is greatly influenced by the detection thresholds and types of data used, as they exhibit varying degrees and types of continuity that may determine the success of ML models.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.