ShieldFS is an innovative solution to fight ransomware attacks. It automatically creates detection models that distinguish ransomware from benign processes at runtime on the base of the filesystem activity. ShieldFS adapts these models to the filesystem usage habits observed on the protected system. ShieldFS applies the detection approach in a real-time, self-healing virtual filesystem that shadows the write operations and reverts the effects of ransomware attacks safeguarding the integrity of users' data. Thus, if a file is modified by one or more malicious processes, the filesystem presents the original, mirrored copy to the user space applications. This shadowing mechanism is dynamically activated and deactivated depending on the outcome of the aforementioned detection logic. Additionally, ShieldFS looks for indicators of the use of cryptographic primitives. In particular, ShieldFS scans the memory of any process considered as potentially malicious, searching for traces of the typical block cipher key schedules.
ShieldFS is a research project developed at NECSTLab, DEIB - Politecnico di
Milano.
|
[1] |
ShieldFS: A Self-healing, Ransomware-aware Filesystem |
|
[2] |
ShieldFS: The Last Word In Ransomware Resilient Filesystems |
NECSTLab
Via Ponzio, 34/5
20133 Milano, Italy
The NECST Lab (Novel, Emerging Computing System Technologies Laboratory) comprises a number of different research lines on advanced topics in computing systems, ranging from architectural characteristics, to hardware- software codesign methodologies, to security and dependability issues of complex system architectures (scaling from mobile devices to large virtualized datacenters).
Furthermore, the laboratory pursues its historical tradition of research in the definition of methodologies and techniques regarding testability, auto-diagnosis and fault tolerance both for hardware architectures and hardware-software systems.
Further information about the NECSTLab can be found on the NECSTLab official website or Facebook page.
In order to understand how ransomware compares to benign software from the filesystem's viewpoint, we analyzed in depth how benign software typically interacts with the filesystem on real-world computers. We performed the first large-scale data collection of I/O request packets (IRPs) from real- world, ransomware-free machines, to profile the low-level filesystem activity in normal conditions. We collected and anonymized data from 11 machines used by volunteers for their typical day-to-day tasks (i.e., personal, office, and development).
In the spirit of open science we are happy to release our dataset to the community. If you are interested in getting access to our data, send us an email.
Press covering our work:
WIRED: https://www.wired.com/story/shieldfs-ransomware-protection-tool/
DarkReading Live Interview: https://youtu.be/jjbsMHAU674?t=4343
01net (French): http://www.01net.com/actualites/shieldfs-l-outil-qui-rendra-votre-pc-invulnerable-aux-ransomwares-1225574.html
eSecurity Planet: http://www.esecurityplanet.com/threats/black-hat-building-a-ransomware-resilient-filesystem-with-shieldfs.html
BleepingComputer: https://www.bleepingcomputer.com/news/security/shieldfs-can-stop-and-revert-the-effects-of-ransomware-infections/
Tom's guide: https://www.tomsguide.com/us/shieldfs-stops-ransomware,news-25547.html
Libero (Italian): http://tecnologia.libero.it/shieldfs-il-radar-per-ransomware-creato-al-politecnico-di-milano-14013
HISPASEC (Spanish): http://unaaldia.hispasec.com/2017/07/shieldfs-un-sistema-de-ficheros-contra.html?spref=tw
Threatpost: https://threatpost.com/shieldfs-can-detect-ransomware-recover-files/127121/
Fastweb (Italian): http://www.fastweb.it/web-e-digital/shieldfs-il-tool-italiano-che-blocca-i-ransomware/
Information Security Newspaper: http://www.securitynewspaper.com/2017/07/27/shieldfs-can-stop-revert-effects-ransom-ware-infections/
Fossbytes: https://fossbytes.com/shieldfs-anti-ransomware-addon/
Dataloss: https://dataloss.com/ransomware-and-viruses/shieldfs-stops-ransomware/
TAD GROUP: https://www.tad.bg/en/post/shieldfs-can-stop-the-ransomware-infections-and-revert-the-damage
The Merkle: https://themerkle.com/new-shieldfs-tool-can-stop-a-ransomware-attack-in-its-tracks/
Latest Hacking News: https://latesthackingnews.com/2017/07/27/new-project-called-shieldfs-can-stop-ransomware-attacks/
