Impact of File-Open Hook Points on Backup Ratio in ROFBS on XFS

2026-03-17

AI Summary

This study addresses the limitations of existing real-time backup mechanisms against ransomware, which often fail due to suboptimal placement of file-open hooks, allowing attackers to encrypt files during detection delays. Without altering the underlying ROFBS framework, the authors present the first systematic quantitative evaluation of five kernel hook points—may_open, inode_permission, do_dentry_open, security_file_open, and xfs_file_open—along the Linux file-open path under the XFS filesystem, assessing their impact on backup ratio and encryption scope. Empirical experiments on AlmaLinux employ three ransomware families: AvosLocker, Conti, and IceFire. Results demonstrate that xfs_file_open achieves the highest backup ratios (100.0% for Conti and 63.2% for IceFire) while consistently minimizing the total number of encrypted files; security_file_open performs best against AvosLocker (82.5%), underscoring the critical defensive value of filesystem-layer hooks.

Technology Category

• Search and Optimization: Metareasoning and Metaheuristics
• Computer Vision: Adversarial Attacks & Robustness
• Data Mining & Knowledge Management: Anomaly/Outlier Detection

Application Category

• Security and Privacy: Large-scale security measurements
• Responsible Web: Measurement, analysis, and circumvention of Web censorship
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Ransomware continues encrypting files during the delay between attack onset and detection. ROFBS mitigates this problem by backing up pre-modification files in real time upon file-open events. However, because the Linux file-open path traverses multiple kernel functions, it remains unclear how the choice of hook point affects defense effectiveness. In this study, we kept the ROFBS mechanism fixed and changed only the hook points on the Linux file-open path. We compared may_open, inode_permission, do_dentry_open, security_file_open, and xfs_file_open on AlmaLinux with XFS using three ransomware families: AvosLocker, Conti, and IceFire. We used Backup Ratio as the main metric and also compared the number of encrypted files with backups and the total number of encrypted files. The results showed that hook-point selection substantially affected both recoverability and damage scale. For AvosLocker, security_file_open achieved the highest Backup Ratio (82.5%). For Conti and IceFire, xfs_file_open achieved the highest values (100.0% and 63.2%, respectively). Moreover, xfs_file_open minimized the total number of encrypted files for all three ransomware families. These results indicate that, in ROFBS, the layer at which file-open events are observed is a key design factor. In particular, on XFS, hooking the filesystem-specific callback xfs_file_open may be advantageous when the goal is to reduce overall damage.

Problem

• ROFBS
• hook point
• ransomware
• XFS
• Backup Ratio

Innovation

• hook point
• ROFBS
• Backup Ratio
• XFS
• ransomware defense