MTFS: a Moving Target Defense-Enabled File System for Malware Mitigation

Ransomware has remained one of the most notorious threats in the cybersecurity field, for which Moving Target Defense (MTD) has been proposed as a novel defense paradigm. Although various approaches leverage MTD, few of them rely on the operating system and, specifically, the file system, thereby making them dependent on other computing devices, rendering defense against certain threats unrealistic. File-based approaches are less studied here while showing limitations in resource usage and defense effectiveness. Furthermore, existing ransomware defenses merely restore data or detect attacks without preventing them. Thus, this paper introduces the MTFS file system and the design and implementation of three novel MTD techniques – one delaying attackers, one trapping recursive directory traversal, and another one hiding file types. The effectiveness of the techniques is shown in three experiments. First, it is demonstrated that the techniques can delay and mitigate ransomware on real IoT devices. Secondly, in a broader scope, the solution was confronted with 13 ransomware samples, highlighting that it can save 97% of the files. Regarding overhead, the defense system consumes only a small amount of resources, highlighting the feasibility of proactive defense.