发表机构
Kogakuin University（工学院大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本研究从文件生命周期角度设计并评估四种实时备份触发策略（打开、读取、写入、重命名），在XFS上实现ROFBS风格原型并用五个勒索软件样本测试，揭示触发时机对损害缓解和备份数量的影响，为选择有效触发器提供设计指导。
AI 中文摘要
勒索软件在攻击开始与检测之间的间隔内持续加密文件。实时备份可以通过在文件被修改之前保存文件来减轻这种损害。先前提出的实时开放文件备份系统（ROFBS）主要在文件打开事件时触发备份。然而，文件生命周期提供了多个候选触发点，包括打开、读取、写入和重命名操作。过早触发备份可能会产生不必要的备份文件，而过晚触发备份则可能使勒索软件的写入与备份创建竞争，从而无法保留干净的文件内容。因此，目前尚不清楚哪种触发时机能在可恢复性和创建的备份数量之间取得最佳平衡。在本研究中，我们从文件生命周期的角度设计和评估用于减轻勒索软件损害的实时备份触发器。具体而言，我们比较了四种策略：打开时备份、读取时备份、写入时备份和重命名时备份。我们在XFS上实现了这些策略的ROFBS风格原型，并使用五个勒索软件样本（Conti、Sodinokibi、AvosLocker、REvil和HelloKitty）进行评估。我们的结果阐明了触发时机如何影响损害缓解和创建的备份数量，为在实时备份系统中针对勒索软件选择有效触发器提供了设计指导。
英文摘要
Ransomware continues to encrypt files during the interval between attack onset and detection. Real-time backups can mitigate this damage by preserving files before they are modified. The previously proposed Real-Time Open-File Backup System (ROFBS) triggers backups primarily on file-open events. However, the file lifecycle offers several candidate trigger points, including open, read, write, and rename operations. Triggering backups too early may create unnecessary backup files, whereas triggering them too late may allow ransomware writes to race with backup creation and prevent the preservation of clean file contents. Consequently, it remains unclear which trigger timing best balances recoverability and the number of backups created. In this study, we design and evaluate real-time backup triggers for mitigating ransomware damage from a file-lifecycle perspective. Specifically, we compare four strategies: Open-time backup, Read-time backup, Write-time backup, and Rename-time backup. We implement these strategies in an ROFBS-style prototype on XFS and evaluate them using five ransomware samples: Conti, Sodinokibi, AvosLocker, REvil, and HelloKitty. Our results clarify how trigger timing affects both damage mitigation and the number of backups created, providing design guidance for selecting effective triggers in real-time backup systems against ransomware.
