ROFBS$alpha$: Real Time Backup System Decoupled from ML Based Ransomware Detection

2025-04-19

AI Summary

To address high response latency and resource contention between detection and backup operations in ML-driven ransomware detection systems—which often leads to protection failures—this paper proposes ROFBSα, a real-time backup architecture. Its core innovation is the first implementation of complete decoupling and asynchronous execution of detection and backup tasks: eBPF enables zero-intrusion monitoring of file-open events, while lightweight hooks deployed at the Linux VFS layer trigger low-overhead, asynchronous backup scheduling. Evaluated on three representative ransomware families—AvosLocker, Conti, and IceFire—ROFBSα achieves a backup success rate exceeding 98%, reduces average detection latency by 42%, and incurs less than 3% additional system overhead. The design jointly optimizes real-time responsiveness, robustness, and resource efficiency, establishing a practical, co-designed defense paradigm for ML-based security systems.

Technology Category

• Machine Learning: Hardware-aware ML
• Computer Vision: Adversarial Attacks & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• Security and Privacy: Cyber-crime defenses and forensics
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Responsible Web: Measurement, analysis, and circumvention of Web censorship

Abstract

This study introduces ROFBS$alpha$, a new defense architecture that addresses delays in detection in ransomware detectors based on machine learning. It builds on our earlier Real Time Open File Backup System, ROFBS, by adopting an asynchronous design that separates backup operations from detection tasks. By using eBPF to monitor file open events and running the backup process independently, the system avoids performance limitations when detection and protection contend for resources. We evaluated ROFBS$alpha$ against three ransomware strains, AvosLocker, Conti, and IceFire. The evaluation measured the number of files encrypted, the number of files successfully backed up, the ratio of backups to encrypted files, and the overall detection latency. The results show that ROFBS$alpha$ achieves high backup success rates and faster detection while adding minimal extra load to the system. However, defending against ransomware that encrypts files extremely quickly remains an open challenge that will require further enhancements.

Problem

• Reduces detection delays in ML-based ransomware defense
• Decouples backup operations from detection for efficiency
• Improves file protection speed with minimal system load

Innovation

• Asynchronous design separates backup and detection
• Uses eBPF to monitor file open events
• Independent backup process avoids resource contention