DEFEAT: Stitching Fragmented File I/O Contexts for Early Ransomware Detection
DEFEAT reconstructs fragmented ransomware file I/O and can detect encryption at the first file.
DEFEAT groups causally related file events into File Event Gadgets that capture encryption intent across temporary and intermediate files. Each gadget is modeled as an attributed control-flow graph and embedded with a graph neural network for unsupervised clustering, reducing annotation effort by 94%. On 97,816,471 I/O events from 67 ransomware families it reached 99.2% accuracy, outperforming UNVEIL, RWGuard, and Peeler by 6.57 to 7.56%, and can assign a label when the first file is encrypted.
- File Event Gadgets stitch I/O scattered across temporary files.
- Unsupervised graph clustering cuts labeling effort by 94%.
- 99.2% accuracy on 67 families and 97.8 million events.
- A cluster can be labeled at the first encrypted file.
- Beats UNVEIL, RWGuard, and Peeler by 6.57–7.56%.
Full article251 words · extracted from arxiv.org · click to collapse
Ransomware increasingly fragments its file operations across temporary and intermediate files, scattering the semantic context that links individual I/O events to an overarching encryption campaign. This fragmentation defeats existing detectors that reason over isolated file streams -- whether pattern-based methods that match rigid event sequences or learning-based methods that require accumulating statistical evidence across many files. We present DEFEAT, a framework that reconstructs this fragmented, scattered context by grouping causally related file events into File Event Gadgets (FEGs), semantically coherent units that capture the full intent behind sequences of file operations spanning multiple dynamically created files. Unlike provenance graphs (system-wide causal graphs that record relationships among all OS entities, such as processes, files, sockets, and registry keys, across the entire system), FEGs are scoped to the file-operation context of a single user asset, enabling lightweight, targeted analysis without whole-system instrumentation. Each FEG is modelled as an attributed control flow graph (ACFG) and embedded via a graph neural network for unsupervised clustering, enabling analysts to label entire behavioural clusters rather than individual samples, reducing annotation effort by 94%. Evaluated on a corpus of 97,816,471 file I/O events spanning 67 ransomware families, DEFEAT achieves 99.2% detection accuracy and outperforms state-of-the-art methods including UNVEIL, RWGuard, and Peeler by 6.57 to 7.56%. The framework operates at the granularity of a single file encryption: because each ACFG represents exactly one FEG (one user asset context), a cluster label can be assigned as soon as the first file operation completes, enabling detection at the first encrypted file.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.21426