Ranflood: A mitigation tool based on the principles of data flooding against ransomware - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Article Dans Une Revue SoftwareX Année : 2024

Ranflood: A mitigation tool based on the principles of data flooding against ransomware

Résumé

Crypto-ransomware aims at extorting money from users by encrypting their files and asking them to pay for the decryption key. We present Ranflood; a configurable drop-in solution that contrasts ransomware attacks with a deluge of decoy files at specific locations (e.g., sensitive folders of the user, the attack site), deceiving the attacker into encrypting sacrificial files. Ranflood further slows down the attack by contending with the malware access to IO and computation resources of the targeted machine. The aim is to buy time for the defence team to take action (e.g., manually shutting down an unresponsive machine). We show how the extensibility and modularity of Ranflood's software architecture (1) can accommodate a wide spectrum of flooding strategies, easing the process of improving its effectiveness also against future ransomware families and (2) strive to maximise the tool's efficiency by exploiting the highest level of parallelism afforded by the attacked machine.
Fichier principal
Vignette du fichier
softwarex2023.pdf (569.27 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04362711 , version 1 (23-12-2023)

Licence

Paternité

Identifiants

Citer

Davide Berardi, Saverio Giallorenzo, Andrea Melis, Simone Melloni, Marco Prandini. Ranflood: A mitigation tool based on the principles of data flooding against ransomware. SoftwareX, 2024, 25, pp.101605. ⟨10.1016/j.softx.2023.101605⟩. ⟨hal-04362711⟩
23 Consultations
7 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More