4 research outputs found
R-Locker: Thwarting Ransomware Action through a Honey le-based Approach
Ransomware has become a pandemic nowadays. Although some proposals
exist to fight against this increasing type of extorsion, most of them are prevention like and rely on the assumption that early detection is not so effective
once the victim is infected. This paper presents a novel approach intended
not just to early detect ransomware but to completly thwart its action. For
that, a set of honeyfiles are deployed around the target environment in order
to catch the ransomware. Instead of being normal archives, honeyfiles are
FIFO like, so that the ransomware is blocked once it starts reading the file.
In addition to frustrate its action, our honeyfile solution is able to automatically launch countermeasures to solve the infection. Moreover, as it does not
require previous training or knowledge, the approach allows fighting against
unknown, zero-day ransomware related attacks. As a proof of concept, we
have developed the approach for Unix platforms. The tool, named R-Locker,
shows excellent performance both from the perspective of its accuracy as well
as in terms of complexity and resource consumption. In addition, it has no
special needs or privileges and does not affect the normal operation of the
overall environment