File event stitching improves ransomware detection at first encrypted file
DEFEAT: Stitching Fragmented File I/O Contexts for Early Ransomware Detection
Cryptography and Security
Summary
Ransomware attacks hide by breaking their file operations into many small steps across multiple temporary files, making it hard to spot. The authors designed DEFEAT, a system that groups related file actions into one meaningful unit, capturing the attack's full intent. This lets DEFEAT detect ransomware very early, at the very first encrypted file, with high accuracy. It works without needing to monitor the entire system, focusing narrowly on each user file’s activity.
What this means in practice
- •For security operation teams: Deploy early ransomware detection tools that identify attacks at the first encrypted file by analyzing grouped file events instead of isolated streams.
- •For endpoint security developers: Integrate lightweight file-context analysis in endpoint security agents to improve ransomware detection accuracy without full system monitoring overhead.$Commercial implications: Enables advanced ransomware detection capabilities for endpoint security products by offering efficient file context reconstruction and early warning.
Authors
Muhammad Ejaz Ahmed, Hyoungshick Kim, Mohsen Ali Alawami, Alsharif Abuadbba, Seyit Camtepe, Surya Nepal, Junaid Qadir
Abstract
Ransomware increasingly fragments its file operations across temporary and intermediate files, scattering the semantic context that links individual I/O events to an overarching encryption campaign. This fragmentation defeats existing detectors that reason over isolated file streams -- whether pattern-based methods that match rigid event sequences or learning-based methods that require accumulating statistical evidence across many files. We present DEFEAT, a framework that reconstructs this fragmented, scattered context by grouping causally related file events into File Event Gadgets (FEGs), semantically coherent units that capture the full intent behind sequences of file operations spanning multiple dynamically created files. Unlike provenance graphs (system-wide causal graphs that record relationships among all OS entities, such as processes, files, sockets, and registry keys, across the entire system), FEGs are scoped to the file-operation context of a single user asset, enabling lightweight, targeted analysis without whole-system instrumentation. Each FEG is modelled as an attributed control flow graph (ACFG) and embedded via a graph neural network for unsupervised clustering, enabling analysts to label entire behavioural clusters rather than individual samples, reducing annotation effort by 94%. Evaluated on a corpus of 97,816,471 file I/O events spanning 67 ransomware families, DEFEAT achieves 99.2% detection accuracy and outperforms state-of-the-art methods including UNVEIL, RWGuard, and Peeler by 6.57 to 7.56%. The framework operates at the granularity of a single file encryption: because each ACFG represents exactly one FEG (one user asset context), a cluster label can be assigned as soon as the first file operation completes, enabling detection at the first encrypted file.