CRII: SaTC: An Integrated Treatment of Ransomware Through Microarchitecture and Software Solutions

Regents Of The University Of Michigan - Ann Arbor, Ann Arbor MI

Investigators

Abstract

Cyber-criminals are constantly seeking ways to make their attacks profitable. As a result, various mobile users, businesses, and government agencies are falling victim to a new disruptive class of malware known as ransomware. Ransomware allows attackers to maliciously encrypt user data then extort them for ransom in return for restoring their encrypted data. This project aims to develop novel detection and recovery solutions to defend against ransomware across mobile and computer systems while introducing minimal performance overhead. This research will investigate novel defenses against ransomware attacks. The first part of this project will focus on harnessing convolutional neural networks for ransomware detection across heterogeneous architectures that span mobile and computer systems. This work devises a framework that maps application instructions into different spatial representations. It will then evaluate the effectiveness of such representations in detecting ransomware with convolutional neural networks. The second part will focus on the development of a new end-to-end solution that spans the microarchitecture, firmware, and operating system layers to recover maliciously encrypted data. This research has the potential to substantially improve the overall security of systems and data availability against ransomware threats across the computing spectrum and enhance the availability of personal and business data that drives our society. Given the emphasis of this project on data, which serves as the impetus of our society, the work is expected to have a significant impact on the computing industry, society, law enforcement, and United States national security. In addition, this project integrates the research activities with education and outreach to broaden the participation of women and minorities in computer science disciplines. The data generated through this project will be deposited into Deep Blue Data, the University of Michigan’s institutional data repository. Content in Deep Blue Data is stored on network storage with proper backup in campus data centers. Published results and collected data will be available via this system over the duration of the project and for a minimum of three years after the conclusion of the award. Further information on the project repository will be made accessible at https://anysbacha.github.io. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.