让蜂蜜文件更甜蜜：SentryFS --一种面向服务的智能勒索软件解决方案
Making Honey Files Sweeter: SentryFS -- A Service-Oriented Smart Ransomware Solution
摘要：
勒索软件的传播继续造成破坏，是安全社区的主要担忧。针对这种威胁的一种常用技术是使用蜂蜜（或金丝雀）文件，这些文件作为“绊线”在早期阶段检测勒索软件。然而，在我们对野生勒索软件样本的分析中，我们发现攻击者非常清楚这些陷阱，并且新的变种使用几种规避策略来绕过传统的蜂蜜文件。因此，我们提出了SentryFS的设计-一个专门的文件系统，战略性地在整个文件系统“喷洒”特制的蜂蜜文件。金丝雀使用自然语言处理（NLP）生成，内容和元数据不断更新，以使金丝雀对选择受害者文件的智能勒索软件更具吸引力。此外，为了帮助管理蜂蜜文件，SentryFS与反勒索软件Web服务连接，以下载有关新型勒索软件策略的最新情报，以更新金丝雀。最后，作为应急措施，SentryFS还利用文件克隆来防止进程在高度隐蔽的勒索软件未被检测到的情况下直接写入文件。在这种情况下，勒索软件加密克隆而不是实际文件，使用户的数据未经修改。然后，人工智能智能体为写入活动分配一个怀疑分数，以便用户可以批准/放弃更改。作为一个早期预警系统，拟议的设计可能有助于减轻勒索软件的问题。
英文摘要：
The spread of ransomware continues to cause devastation and is a major concern for the security community. An often-used technique against this threat is the use of honey (or canary) files, which serve as ``trip wires'' to detect ransomware in its early stages. However, in our analysis of ransomware samples from the wild, we discovered that attackers are well-aware of these traps, and newer variants use several evasive strategies to bypass traditional honey files. Hence, we present the design of SentryFS - a specialized file system that strategically ``sprays'' specially-crafted honey files across the file system. The canaries are generated using Natural Language Processing (NLP) and the content and the metadata is constantly updated to make the canaries appear more attractive for smarter ransomware that is selective in choosing victim files. Furthermore, to assist with the management of the honey files, SentryFS connects with an anti-ransomware web service to download the latest intelligence on novel ransomware strategies to update the canaries. Finally, as a contingency, SentryFS also leverages file clones to prevent processes from writing to files directly in the event a highly stealthy ransomware goes undetected. In this case, the ransomware encrypts the clones rather than the actual files, leaving users' data unmodified. An AI agent then assigns a suspicion score to the write activity so that users can approve/discard the changes. As an early-warning system, the proposed design might help mitigate the problem of ransomware.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
