ShieldFS: The Last Word in Ransomware Resilient Filesystems Andrea Continella , Alessandro Guagnelli, Giovanni Zingaro, Giulio De Pasquale, Alessandro Barenghi, Stefano Zanero, Federico Maggi * US patent pending
2016-17 the "years of extortion"
Do you WannaCry?
Do you WannaCry?
ShieldFS vs WannaCry ShieldFS detected WannaCry after it encrypted >=200 files Files lost: zero , all were recovered automatically
It’s not just WannaCry... ➢ Detected: 1436/1483, 96.9% ➢ Files lost: always 0%
Why ShieldFS is different?
ShieldFS: Key Takeaways The way ransomware interacts with the filesystem is significantly different than benign applications
ShieldFS: Key Takeaways The way ransomware interacts with the filesystem is significantly different than benign applications DETECTION. Monitor filesystem activity Usage of crypto primitives
ShieldFS: Key Takeaways The way ransomware interacts with the filesystem is significantly different than benign applications DETECTION. Monitor filesystem activity Usage of crypto primitives PROTECTION. Mere detection is insufficient ➢ Stopping a suspicious process may be too late ➢ We need to protect users’ data , reverting the effects of ransomware attacks.
What does ShieldFS observe?
FS Activity Monitor Process User mode User mode Kernel mode I/O Manager ➢ Windows Kernel module to monitor and log the Filter Manager file system activity ○ Windows Minifilter Driver File System ○ Log IRPs (I/O Request Packets) Storage Driver Hardware
Filter Manager API CONST FLT_OPERATION_REGISTRATION Callbacks[] = { { IRP_MJ_CREATE, 0, PreCreateOperationCallback, PostCreateOperationCallback }, { IRP_MJ_CLOSE, 0, PreCloseOperationCallback, PostCloseOperationCallback }, { IRP_MJ_READ, 0, PreReadOperationCallback, PostReadOperationCallback }, { IRP_MJ_WRITE, 0, PreWriteOperationCallback, PostWriteOperationCallback }, } FltRegisterFilter(DriverObject, &FilterRegistration, &Filter);
IRP Log Example
Where do we start from?
Background/Clean FS Activity Benign User mode ➢ IRP logger on 11 clean machines Kernel mode ➢ FS activity under "typical" usage I/O Manager ○ ~1 month worth of data IRPLogger File System IRPs IRPs Storage Driver IRPs Disk drive IRPs
Collected FS Activity
Collected FS Activity
Analysis Environment Windows 7 VM 383 samples of 5 distinct families Ransomware User mode Kernel mode I/O Manager IRPLogger File System Disk drive VirtualBox Cuckoo Sandbox
Environment Preparation ● Trigger ransomware activity ● Avoid anti-sandbox tricks
Ransomware vs Benign apps ? ? ? Benign Ransomware User mode Kernel mode I/O Manager IRPLogger File System Storage Driver Disk drive
ShieldFS Self-healing Ransomware-aware Filesystem
Ransomware vs Benign apps
Ransomware vs Benign apps MANY PROGRAMS MANY PROGRAMS exhibit exhibit LOW VALUE HIGH VALUE FEW PROGRAMS FEW PROGRAMS exhibit exhibit LOW VALUE HIGH VALUE
Ransomware vs Benign apps Ransomware Benign (1) #Folder-listing
Ransomware vs Benign apps Ransomware Benign (2) #Files-Read
Ransomware vs Benign apps Ransomware Benign (3) #Files-Written
Ransomware vs Benign apps Ransomware Benign (4) #Files-Renamed
Ransomware vs Benign apps Ransomware Benign (5) File type coverage
Ransomware vs Benign apps Ransomware Benign (6) Write-Entropy
Ransomware vs Benign apps
Machine Learning Learned classification model
ShieldFS Self-healing Ransomware-aware Filesystem
ShieldFS: Healing Approach
ShieldFS: Healing Approach
THIS SLIDE IS TO PROVE THAT WE CAN CREATE COMPLEX ANIMATION FLOWS
THIS SLIDE IS TO PROVE THAT WE CAN CREATE COMPLEX ANIMATION FLOWS
Detection Models Process #1 Process #n Process-centric Models K System-centric Model Disk drive
Multi-tier Incremental Models K Long-term horizon Global Model Model 3 Model 3 tiers Model 2 Model 2 Model 2 Short-term horizon Model 1 Model 1 Model 1 Model 1 Model 1 Model 1 log (% accessed files)
Multi-tier Incremental Models tick #0 Long-term horizon Global Model Model 3 Model 3 tiers Model 2 Model 2 Model 2 Short-term horizon Model 1 Model 1 Model 1 Model 1 Model 1 Model 1 #0 #1 #2 #3 log (% accessed files)
Multi-tier Incremental Models tick #1 Long-term horizon Global Model Model 3 Model 3 tiers Model 2 Model 2 Model 2 Short-term horizon Model 1 Model 1 Model 1 Model 1 Model 1 Model 1 #0 #1 #2 #3 log (% accessed files)
Multi-tier Incremental Models tick #2 Long-term horizon Global Model Model 3 Model 3 tiers Model 2 Model 2 Model 2 Short-term horizon Model 1 Model 1 Model 1 Model 1 Model 1 Model 1 #0 #1 #2 #3 log (% accessed files)
Multi-tier Incremental Models tick #3 Long-term horizon Global Model Model 3 Model 3 tiers Model 2 Model 2 Model 2 Short-term horizon Model 1 Model 1 Model 1 Model 1 Model 1 Model 1 #0 #1 #2 #3 log (% accessed files)
Multi-tier Incremental Models tick #4 Long-term horizon Global Model Model 3 Model 3 tiers Model 2 Model 2 Model 2 Short-term horizon Model 1 Model 1 Model 1 Model 1 Model 1 Model 1 #0 #1 #2 #3 log (% accessed files)
Multi-tier Incremental Models tick #5 Long-term horizon Global Model Model 3 Model 3 tiers Model 2 Model 2 Model 2 Short-term horizon Model 1 Model 1 Model 1 Model 1 Model 1 Model 1 #0 #1 #2 #3 log (% accessed files)
Multi-tier Incremental Models Malicious Long-term horizon Global Model Model 3 Model 3 tiers Model 2 Model 2 Model 2 Short-term horizon Model 1 Model 1 Model 1 Model 1 Model 1 Model 1 #0 #1 #2 #3 log (% accessed files)
Multi-tier Incremental Models Benign Long-term horizon Global Model Model 3 Model 3 tiers Model 2 Model 2 Model 2 Short-term horizon Model 1 Model 1 Model 1 Model 1 Model 1 Model 1 #0 #1 #2 #3 log (% accessed files)
Multi-tier Incremental Models ? ? ? Suspicious Long-term horizon Global Model Model 3 Model 3 tiers Model 2 Model 2 Model 2 Short-term horizon Model 1 Model 1 Model 1 Model 1 Model 1 Model 1 #0 #1 #2 #3 log (% accessed files)
I’m Confused.. Suspicious Process #1 Process #n Process-centric Models System-centric Model
I’m Confused.. Suspicious Process #1 Process #n Process-centric Models LOOK FOR TRACES OF CRYPTO FUNCTIONS System-centric Model
Block Ciphers: Key Schedule
Traces of Crypto Primitives Key schedules Encryption Rounds 77 3f 9d 50 2a 91 d5 86 Round 1 a0 89 42 b2 f3 de b8 d3 32 f2 16 b0 88 e3 7e b4 Round 2 1d 2d f4 b2 fa 6f 51 64 bd ce c7 e5 16 1b e1 dc Round 3 8f db 81 e5 50 8b c0 1a 7b 93 8f f4 64 c9 bf f3 Round N a5 f8 25 be f5 9a 48 c8
Traces of Crypto Primitives Key schedules Encryption Rounds 77 3f 9d 50 2a 91 d5 86 Round 1 a0 89 42 b2 f3 de b8 d3 32 f2 16 b0 88 e3 7e b4 Round 2 1d 2d f4 b2 fa 6f 51 64 False Positives for AES: 2 -1344 bd ce c7 e5 16 1b e1 dc Round 3 8f db 81 e5 50 8b c0 1a 7b 93 8f f4 64 c9 bf f3 Round N a5 f8 25 be f5 9a 48 c8
ShieldFS: Architecture Process 1 Process 2 . . . Virtual memory address space address space Process 1 Process 2 ... open("file.txt") read(fp1) ... User space Kernel space I/O Manager (minifilter driver interface)
ShieldFS: Architecture Process 1 Process 2 . . . Virtual memory address space address space Process 1 Process 2 ... open("file.txt") read(fp1) ... User space Kernel space I/O Manager (minifilter driver interface) I/O Request Packets (IRPs) Process centric Process centric ... model 1 model 2 Feature values " process 1 is suspicious" Detector System centric model
ShieldFS: Architecture Process 1 Process 2 . . . Virtual memory address space address space Process 1 Process 2 ... open("file.txt") read(fp1) ... User space " search for crypto key schedule" Kernel space I/O Manager (minifilter driver interface) I/O Request Packets (IRPs) Process centric Process centric ... CryptoFinder model 1 model 2 Feature values " process 1 is suspicious" Detector System centric model
ShieldFS: Architecture Process 1 Process 2 . . . Virtual memory address space address space Process 1 Process 2 ... open("file.txt") read(fp1) ... User space " search for crypto key schedule" Kernel space I/O Manager (minifilter driver interface) I/O Request Packets (IRPs) Process centric Process centric ... CryptoFinder model 1 model 2 Feature values " process 1 is suspicious" Detector System centric model " process 2 is benign", " process 1 is malicious: kill it and restore files" Shielder “delete process 2 file copies” “restore process 1 files copies” Disk drive Shadow drive
Recommend
More recommend
