RAfFLES: Ransomware-Aware Flash-basEd Storage

Ransomware is an international crime operation that strikes commercial, public and government organizations. It is estimated that ransomware has cost nearly $5 billion in damages worldwide in 2017 alone, and if left unmitigated, by 2019 will hit an enterprise every 14 seconds causing a projected total loss of $11.5 billion. The IAI team proposes to take advantage of the intrinsic flash properties and build a ransomware-tolerant flash-based storage which has a lightweight hardware-assisted data recovery system. Such firmware-level recovery system allows quick and effective recovery from encryption ransomware without relying on explicit backups. It is transparent to upper-level systems software and applications, and the proposed techniques have sufficiently low-performance overhead and can be adopted in a variety of computing platforms and storage mediums such as solid-state drive (SSD), embedded multimedia card (eMMC), and USB sticks. The solution ensures isolated data recovery even on OS-compromised computer systems and utilizes the internal parallelism provided by flash-based storage devices to dramatically reduce the time of recovering user data. Our approach does not require any code modifications to the existing file systems and applications, hence it can be easily deployable in a variety of computing platforms such as servers, desktops, and even mobile devices.