Recovery Method for Ransomware Encryption Attacks with File Extension Changing on File Server

Cryptographic ransomware, which encrypts and disables accessing files and demands money in exchange for decryption, is causing damage to businesses. Conventional auto-matic restoration running on a PC as a countermeasure against an encryption attack requires the installation, which increases PC maintenance costs. Unlike the conventional method where data was stored on each terminal, if data is handled only on the file server, only the file server needs to be protected from encryption attacks, thus reducing management costs for the entire organization. In this study, focusing on the behavior of known samples that change file extensions to specific ones, we propose a method to identify and roll back file operations caused by cryptographic attacks on file servers. We evaluated the proposed system by performing an encryption attack on it using mock ransomware implemented according to the typical behavior of ransomware that changes the file extension to a specific one. The proposed system can identify and roll back file operations performed by the ransomware and automatically recover files that have been encrypted in a short time.