ROFBS$α$: Real Time Backup System Decoupled from ML Based Ransomware Detection
Kosuke Higuchi, Ryotaro Kobayashi
TL;DR
Ransomware detectors based on machine learning incur a detection-time latency that can permit encryption before mitigation. ROFBSα proposes an asynchronous defense that decouples the backup mechanism from the detector, using eBPF-driven file-open monitoring to back up targets independently and promptly, thereby reducing damage during detection latency. Evaluations against AvosLocker, Conti, and IceFire show near-perfect backup ratios for key attacks and substantial reductions in detection time with RF-based models, while maintaining acceptable overhead. The approach offers a practical, kernel-level defense that complements ML detectors, with open challenges for extremely fast encryption speeds and for GB-based detection variants.
Abstract
This study introduces ROFBS$α$, a new defense architecture that addresses delays in detection in ransomware detectors based on machine learning. It builds on our earlier Real Time Open File Backup System, ROFBS, by adopting an asynchronous design that separates backup operations from detection tasks. By using eBPF to monitor file open events and running the backup process independently, the system avoids performance limitations when detection and protection contend for resources. We evaluated ROFBS$α$ against three ransomware strains, AvosLocker, Conti, and IceFire. The evaluation measured the number of files encrypted, the number of files successfully backed up, the ratio of backups to encrypted files, and the overall detection latency. The results show that ROFBS$α$ achieves high backup success rates and faster detection while adding minimal extra load to the system. However, defending against ransomware that encrypts files extremely quickly remains an open challenge that will require further enhancements.