NTFS+: An Enhanced NTFS File System Against Ransomware Invasions

Abstract

Ransomware poses a significant threat to digital security, evolving rapidly with sophisticated encryption and data exfiltration tactics. This study introduces NTFS+, an enhanced version of the New Technology File System (NTFS), designed to combat these emerging ransomware threats. NTFS+ integrates machine learning, specifically Generative Adversarial Networks, to detect abnormal file system activities indicative of ransomware attacks. The system's core architecture features minifilter drivers that analyze file access patterns in real-time, enabling proactive response to potential threats. Evaluation of NTFS+ demonstrates its efficacy in accurately distinguishing between benign and ransomware activities, with a focus on minimizing false positives and negatives. Despite its effectiveness, challenges such as zero-day ransomware attacks highlight areas for future improvement, including enhanced learning capabilities and cloud integration. NTFS+ represents a significant advancement in file system-based ransomware mitigation, offering a scalable, adaptable, and robust solution for modern cybersecurity needs.