Ransomware-Resilient Self-Healing XML Documents

Abstract

In recent years, various platforms have witnessed an unprecedented increase in the number of ransomware attacks targeting hospitals, governments, enterprises, and end-users. The purpose of this is to maliciously encrypt documents and files on infected machines, depriving victims of access to their data, whereupon attackers would seek some sort of a ransom in return for restoring access to the legitimate owners; hence the name. This cybersecurity threat would inherently cause substantial financial losses and time wastage for affected organizations and users. A great deal of research has taken place across academia and around the industry to combat this threat and mitigate its danger. These ongoing endeavors have resulted in several detection and prevention schemas. Nonetheless, these approaches do not cover all possible risks of losing data. In this paper, we address this facet and provide an efficient solution that would ensure an efficient recovery of XML documents from ransomware attacks. This paper proposes a self-healing version-aware ransomware recovery (SH-VARR) framework for XML documents. The proposed framework is based on the novel idea of using the link concept to maintain file versions in a distributed manner while applying access-control mechanisms to protect these versions from being encrypted or deleted. The proposed SH-VARR framework is experimentally evaluated in terms of storage overhead, time requirement, CPU utilization, and memory usage. Results show that the snapshot size increases proportionately with the original size; the time required is less than 120 ms for files that are less than 1 MB in size; and the highest CPU utilization occurs when using the bzip2. Moreover, when the zip and gzip are used, the memory usage is almost fixed (around 6.8 KBs). In contrast, it increases to around 28 KBs when the bzip2 is used.

Trends and Future Directions in Automated Ransomware Detection

“…The result of this effort is the creation of a decryption key for recovering files held by the ransomware without the need to obtain the attacker's RSA private key or pay a ransom to the attacker. A very recent recovery method is the novel framework proposed as an efficient technique for recovering XML documents that have been compromised by ransomware attack (Al-Dwairi et al, 2022). The approach uses the concepts of links to support the distributed storage of different versions of the same file.…”

Dynamic Ransomware Detection for Windows Platform Using Machine Learning Classifiers

“…It is then used to decrypt the files and folders encrypted by ransomware. SH-VARR is a framework developed by Al-Dwairi et al [18], which utilizes the link concept to protect any XML document from being encrypted or deleted during a ransomware attack.…”

Cybersecurity of Critical Infrastructures: Challenges and Solutions

“…Current solutions against ransomware do not cover all possible risks of data loss. In this article [ 16 ], the authors try to address this aspect and provide an effective solution that ensures efficient recovery of XML documents after ransomware attacks.…”