Files and links (2)
Preprint VersionCC BY-NC-SA V4.0, Open Access
Preprint
Digital Immunity Module: Preventing Unwanted Encryption Digital Immunity Module: Preventing Unwanted Encryption using Source Coding using Source Coding Digital Immunity Module: Preventing Unwanted Encryption using Source Coding Seyit Camtepe
TechRxiv, Vol.8 January 2022
Institute of Electrical and Electronics Engineers
2022
Abstract
Unwanted data encryption, such as ransomware attacks, continues to be a significant cybersecurity threat. Ransomware is a preferred weapon of cybercriminals who target small to large organizations' computer systems and data centres. It is malicious software that infects a victim's computer system and encrypts all its valuable data files. The victim needs to pay a ransom, often in cryptocurrency, in return for a decryption key. Many solutions use methods, including the inspection of file signatures, runtime process behaviors, API calls, and network traffic, to detect ransomware code. However, unwanted data encryption is still a top threat. This paper presents the first immunity solution, called the digital immunity module (DIM). DIM focuses on protecting valuable business-related data files from unwanted encryption rather than detecting malicious codes or processes. We show that methods such as file entropy and fuzzy hashing can be effectively used to sense unwanted encryption on a protected file, triggering our novel source coding method to paralyze the malicious manipulation of data such as ransomware encryption. Specifically, maliciously encrypted data blocks consume exponentially larger space and longer writing time on the DIM-protected file system. As a result, DIM creates enough time for system/human intervention and forensics analysis. Unlike the existing solutions, DIM protects the data regardless of ransomware families and variants. Additionally, DIM can defend against simultaneously active multiple ransomware, including the most recent hard to detect and stop fileless ones. We tested our solution on 39 ransomware families, including the most recent ransomware attacks. DIM successfully defended our sample file dataset (1335 pdf, jpg, and tiff files) against those ransomware attacks with zero file loss.
Details
- Title
- Digital Immunity Module: Preventing Unwanted Encryption Digital Immunity Module: Preventing Unwanted Encryption using Source Coding using Source Coding Digital Immunity Module: Preventing Unwanted Encryption using Source Coding Seyit Camtepe
- Authors
- Keyvan Ansari (Author) - University of the Sunshine Coast, QueenslandArash Mahboubi (Author) - Charles Sturt UniversitySeyit Camtepe (Author) - Commonwealth Scientific and Industrial Research OrganisationJarek Duda (Author) - Jagiellonian UniversityPaweł Morawiecki (Author) - Polish Academy of SciencesMarcin Pawłowski (Author) - Polish Academy of SciencesJosef Pieprzyk (Author) - Commonwealth Scientific and Industrial Research Organisation
- Publication details
- TechRxiv, Vol.8 January 2022
- Publisher
- Institute of Electrical and Electronics Engineers
- Date published
- 2022
- DOI
- 10.36227/techrxiv.17789735.v1
- Copyright note
- This article is posted under a CC BY-NC-SA 4.0 licence. https://creativecommons.org/licenses/by-nc-sa/4.0/
- Organisation Unit
- University of the Sunshine Coast, Queensland; School of Science, Technology and Engineering
- Language
- English
- Record Identifier
- 99605108402621
- Output Type
- Preprint
Metrics
207 File views/ downloads
155 Record Views