techspot Ransomware detection and recovery method for SSDs unveiled by researchers

[UltraMega]

Quote

After the ransomware is stopped, SSD-Insider can recover lost files due to the unique properties of SSDs. "SSDs always keep old versions of data that were overwritten by new data until they are permanently erased by [Garbage Collector]," the paper mentions. "SSD-Insider takes advantage of the built-in backup capability of SSDs. SSD-Insider keeps track of old versions of data inside SSDs and never removes them until the ransomware detection algorithm confirms that the new versions are not affected by ransomwares."

What's truly unique about SSD-Insider is that it works at the firmware level. The team designed SSD-Insider this way to help users who don't keep anti-ransomware software installed on their systems.

The paper also mentions the weaknesses of traditional software methods, like the ability of some ransomware to work against anti-virus software. SSD-Insider is also designed to have less CPU overhead than anti-ransomware software. The paper's abstract says SSD-Insider's software overhead is only around 147 to 254 nanoseconds.

Researchers unveil ransomware detection and recovery method for SSDs

WWW.TECHSPOT.COM

---

The Register spoke with the researchers, who come from Inha University, the Daegu Gyeongbuk Institute of Science & Technology (DGIST), the University of Central Florida (UCF), and...

 

Neat stuff, goes over my head but anything that slows down the spread of ransomware seems good to me.