An official website of the United States government
Ransomware is increasingly prevalent in recent years. To defend against ransomware in computing devices using flash memory as external storage, existing designs extract the entire raw flash memory data to restore the external storage to a good state. However, they cannot allow a fine-grained recovery in terms of user files as raw flash memory data do not have the semantics of "files". In this work, we design FFRecovery, a new ransomware defense strategy that can support fine-grained data recovery after the attacks. Our key idea is, to recover a file corrupted by the ransomware, we can 1) restore its file system metadata via file system forensics, and 2) extract its file data via raw data extraction from the flash translation layer, and 3) assemble the corresponding file system metadata and the file data. A simple prototype of FFRecovery has been developed and some preliminary results are provided.
more »
« less
Enabling per-file data recovery from ransomware attacks via file system forensics and flash translation layer data extraction
Abstract Ransomware attacks are increasingly prevalent in recent years. Crypto-ransomware corrupts files on an infected device and demands a ransom to recover them. In computing devices using flash memory storage (e.g., SSD, MicroSD, etc.), existing designs recover the compromised data by extracting the entire raw flash memory image, restoring the entire external storage to a good prior state. This is feasible through taking advantage of the out-of-place updates feature implemented in the flash translation layer (FTL). However, due to the lack of “file” semantics in the FTL, such a solution does not allow a fine-grained data recovery in terms of files. Considering the file-centric nature of ransomware attacks, recovering the entire disk is mostly unnecessary. In particular, the user may just wish a speedy recovery of certain critical files after a ransomware attack. In this work, we have designed$$\textsf{FFRecovery}$$ , a new ransomware defense strategy that can support fine-grained per file data recovery after the ransomware attack. Our key idea is that, to restore a file corrupted by the ransomware, we (1) restore its file system metadata via file system forensics, and (2) extract its file data via raw data extraction from the FTL, and (3) assemble the corresponding file system metadata and the file data. Another essential aspect of$$\textsf{FFRecovery}$$ is that we add a garbage collection delay and freeze mechanism into the FTL so that no raw data will be lost prior to the recovery and, additionally, the raw data needed for the recovery can be always located. A prototype of$$\textsf{FFRecovery}$$ has been developed and our experiments using real-world ransomware samples demonstrate the effectiveness of$$\textsf{FFRecovery}$$ . We also demonstrate that$$\textsf{FFRecovery}$$ has negligible storage cost and performance impact.
more »
« less
- Award ID(s):
- 2225424
- PAR ID:
- 10560426
- Publisher / Repository:
- Springer Science + Business Media
- Date Published:
- Journal Name:
- Cybersecurity
- Volume:
- 7
- Issue:
- 1
- ISSN:
- 2523-3246
- Format(s):
- Medium: X
- Sponsoring Org:
- National Science Foundation
More Like this
-
-
Abstract In the spanning tree congestion problem, given a connected graphG, the objective is to compute a spanning treeTinGthat minimizes its maximum edge congestion, where the congestion of an edgeeofTis the number of edges inGfor which the unique path inTbetween their endpoints traversese. The problem is known to be$$\mathbb{N}\mathbb{P}$$ -hard, but its approximability is still poorly understood, and it is not even known whether the optimum solution can be efficiently approximated with ratioo(n). In the decision version of this problem, denoted$${\varvec{K}-\textsf {STC}}$$ , we need to determine ifGhas a spanning tree with congestion at mostK. It is known that$${\varvec{K}-\textsf {STC}}$$ is$$\mathbb{N}\mathbb{P}$$ -complete for$$K\ge 8$$ , and this implies a lower bound of 1.125 on the approximation ratio of minimizing congestion. On the other hand,$${\varvec{3}-\textsf {STC}}$$ can be solved in polynomial time, with the complexity status of this problem for$$K\in { \left\{ 4,5,6,7 \right\} }$$ remaining an open problem. We substantially improve the earlier hardness results by proving that$${\varvec{K}-\textsf {STC}}$$ is$$\mathbb{N}\mathbb{P}$$ -complete for$$K\ge 5$$ . This leaves only the case$$K=4$$ open, and improves the lower bound on the approximation ratio to 1.2. Motivated by evidence that minimizing congestion is hard even for graphs of small constant radius, we also consider$${\varvec{K}-\textsf {STC}}$$ restricted to graphs of radius 2, and we prove that this variant is$$\mathbb{N}\mathbb{P}$$ -complete for all$$K\ge 6$$ .more » « less
-
Abstract We introduce the immersion poset$$({\mathcal {P}}(n), \leqslant _I)$$ on partitions, defined by$$\lambda \leqslant _I \mu $$ if and only if$$s_\mu (x_1, \ldots , x_N) - s_\lambda (x_1, \ldots , x_N)$$ is monomial-positive. Relations in the immersion poset determine when irreducible polynomial representations of$$GL_N({\mathbb {C}})$$ form an immersion pair, as defined by Prasad and Raghunathan [7]. We develop injections$$\textsf{SSYT}(\lambda , \nu ) \hookrightarrow \textsf{SSYT}(\mu , \nu )$$ on semistandard Young tableaux given constraints on the shape of$$\lambda $$ , and present results on immersion relations among hook and two column partitions. The standard immersion poset$$({\mathcal {P}}(n), \leqslant _{std})$$ is a refinement of the immersion poset, defined by$$\lambda \leqslant _{std} \mu $$ if and only if$$\lambda \leqslant _D \mu $$ in dominance order and$$f^\lambda \leqslant f^\mu $$ , where$$f^\nu $$ is the number of standard Young tableaux of shape$$\nu $$ . We classify maximal elements of certain shapes in the standard immersion poset using the hook length formula. Finally, we prove Schur-positivity of power sum symmetric functions on conjectured lower intervals in the immersion poset, addressing questions posed by Sundaram [12].more » « less
-
Abstract We show that the Levin-Wen model of a unitary fusion category$${\mathcal {C}}$$ is a gauge theory with gauge symmetry given by the tube algebra$${\text {Tube}}({\mathcal {C}})$$ . In particular, we define a model corresponding to a$${\text {Tube}}({\mathcal {C}})$$ symmetry protected topological phase, and we provide a gauging procedure which results in the corresponding Levin-Wen model. In the case$${\mathcal {C}}=\textsf{Hilb}(G,\omega )$$ , we show how our procedure reduces to the twisted gauging of a trivalG-SPT to produce the Twisted Quantum Double. We further provide an example which is outside the bounds of the current literature, the trivial Fibbonacci SPT, whose gauge theory results in the doubled Fibonacci string-net. Our formalism has a natural topological interpretation with string diagrams living on a punctured sphere. We provide diagrams to supplement our mathematical proofs and to give the reader an intuitive understanding of the subject matter.more » « less
-
Abstract For a given material,controllable deformationsare those deformations that can be maintained in the absence of body forces and by applying only boundary tractions. For a given class of materials,universal deformationsare those deformations that are controllable for any material within the class. In this paper, we characterize the universal deformations in compressible isotropic implicit elasticity defined by solids whose constitutive equations, in terms of the Cauchy stress$$\varvec{\sigma }$$ and the left Cauchy-Green strain$$\textbf{b}$$ , have the implicit form$$\varvec{\textsf{f}}(\varvec{\sigma },\textbf{b})=\textbf{0}$$ . We prove that universal deformations are homogeneous. However, an important observation is that, unlike Cauchy (and Green) elasticity, not every homogeneous deformation is constitutively admissible for a given implicit-elastic solid. In other words, the set of universal deformations is material-dependent, yet it remains a subset of homogeneous deformations.more » « less
