Data Protection Based on Hidden Space in Windows Against Ransomware

Abstract

As ransomware gets more sophisticated, it becomes increasingly challenging to protect user data from ransomware. Ransomware detection tends to entail file loss in spite of successful detection. A great file backup would be to perfectly protect user files from a ransomware attack. Infection of Windows systems has become the most urgent and serious problem, accounting for 99.7% of the systems infected by ransomware. In this paper, we propose a new file backup mechanism to protect user data against ransomware. For this, we use the stealth space, alternate data streams (ADS), in the Windows system. In our mechanism, original files are backed up to an ADS-based hidden secure area in a local system (i.e., a user system), and the recovery keys of the backup files are stored in a remote server. The use of the ADS property allows us to stealthily keep the backup files in a local system while going completely unnoticed by ransomware. The experimental results showed that the encrypted files by a realistic ransomware sample were perfectly protected by our backup mechanism with much smaller transferred data than a traditional remote file backup system.