DEFEAT: Stitching Fragmented File I/O Contexts for Early Ransomware Detection
DEFEAT reconstructs fragmented ransomware file I/O and can detect encryption at the first file.
DEFEAT groups causally related file events into File Event Gadgets that capture encryption intent across temporary and intermediate files. Each gadget is modeled as an attributed control-flow graph and embedded with a graph neural network for unsupervised clustering, reducing annotation effort by 94%. On 97,816,471 I/O events from 67 ransomware families it reached 99.2% accuracy, outperforming UNVEIL, RWGuard, and Peeler by 6.57 to 7.56%, and can assign a label when the first file is encrypted.
- File Event Gadgets stitch I/O scattered across temporary files.
- Unsupervised graph clustering cuts labeling effort by 94%.
- 99.2% accuracy on 67 families and 97.8 million events.
- A cluster can be labeled at the first encrypted file.
- Beats UNVEIL, RWGuard, and Peeler by 6.57–7.56%.
From the original article
1 min read at arxiv.orgRansomware increasingly fragments its file operations across temporary and intermediate files, scattering the semantic context that links individual I/O events to an overarching encryption campaign.
By Muhammad Ejaz Ahmed · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.