Real-time backup triggers reduce ransomware file damage effectively
Lifecycle-Based Design and Evaluation of Real-Time Backup Triggers for Ransomware Damage Mitigation
Cryptography and Security
Summary
Ransomware attacks can encrypt files faster than usual backups can save them, causing damage. The authors studied different moments to save copies of files in real time, like when a file is opened, read, written, or renamed. They found that choosing the best time to back up files affects how well clean versions are saved and how many backup copies get created. Their tests with popular ransomware samples show which backup triggers work better to protect data while avoiding too many backups.
What this means in practice
- •For file system developers: Integrate optimal real-time backup triggers into file system code to improve ransomware damage protection with fewer backups.
- •For enterprise it security teams: Configure backup tools using lifecycle event timing to reduce ransomware damage and backup storage overhead during attacks.
Authors
Kosuke Higuchi, Ryotaro Kobayashi
Abstract
Ransomware continues to encrypt files during the interval between attack onset and detection. Real-time backups can mitigate this damage by preserving files before they are modified. The previously proposed Real-Time Open-File Backup System (ROFBS) triggers backups primarily on file-open events. However, the file lifecycle offers several candidate trigger points, including open, read, write, and rename operations. Triggering backups too early may create unnecessary backup files, whereas triggering them too late may allow ransomware writes to race with backup creation and prevent the preservation of clean file contents. Consequently, it remains unclear which trigger timing best balances recoverability and the number of backups created. In this study, we design and evaluate real-time backup triggers for mitigating ransomware damage from a file-lifecycle perspective. Specifically, we compare four strategies: Open-time backup, Read-time backup, Write-time backup, and Rename-time backup. We implement these strategies in an ROFBS-style prototype on XFS and evaluate them using five ransomware samples: Conti, Sodinokibi, AvosLocker, REvil, and HelloKitty. Our results clarify how trigger timing affects both damage mitigation and the number of backups created, providing design guidance for selecting effective triggers in real-time backup systems against ransomware.