Ransom Access Memories: Achieving Practical Ransomware Protection in Cloud with DeftPunk
Talkat 18th USENIX Symposium on Operating Systems Design and Implementation (OSDI '24) · 2024-07-10..07-12·
summary
DeftPunk is a block-level ransomware detection and recovery system for cloud block stores that pairs a two-layer classifier (fast decision tree front end, XGBoost back end) with pre-/post-attack snapshots plus preserved write logs and log-structured rollback to restore data. Evaluation mixes 16 real workloads and ransomware families across ~400 setups, reporting nearly 100% recall and low runtime overhead, and it targets cloud-specific IO traits like equal read/write ratios, wide LBA churn, and hotspot metadata writes.
AI-written summary · about
chapters (7)
- 0:00Ransomware threats in cloud
- 1:49Current defense limits
- 4:20DeftPunk detection & mitigation
- 9:03Speed vs accuracy in detection
- 11:53DeftPunk architecture & recovery
- 12:58Evaluation results & performance
- 14:04Future challenges & collaboration
related talks
50mRansomware Readiness: Backup and Recovery in the Cloud
38mRansomware and Backups: A Multi-Layered Defense Strategy
30mAnti-ransomware strategies on the cloud
20mWhen ransomware strikes
51mHow to secure your data and applications against ransomware
06mA Battle Plan for Disaster Recovery in the Wake of Ransomare
14mIs a Ransomware Attack in your Future? How to Prevent an Attack
21mRansomware Attack: Lessons Learned