# Can We Use Storage Systems for Ransomware Detection and Recovery

Joshua John, Mai Zheng, Yong Chen, Tina Zou

► To cite this version:

Joshua John, Mai Zheng, Yong Chen, Tina Zou. Can We Use Storage Systems for Ransomware Detection and Recovery. 2026. hal-05470537

HAL Id: hal-05470537

https://hal.science/hal-05470537v1

Preprint submitted on 21 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
# Can We Use Storage Systems for Ransomware Detection and Recovery

Joshua John

Dept. of Electrical and Computer Engineering
Iowa State University
Iowa, USA
joshua98@iastate.edu

Yong Chen

yongchen.l@samsung.com

Mai Zheng

Dept. of Electrical and Computer Engineering
Iowa State University
Iowa, USA
mai@iastate.edu

Tina Zou

Tina.Zou@samsung.com

**Abstract**—Ransomware is a type of malicious software that prevents users from accessing their files and systems, demanding a ransom. It has caused billions of dollars worth of damages to various victims. The classic approach to address the challenge is to scan files and identify ransomware based on their cryptographic hash signature, but this method fails when new families of ransomware are introduced. Newer methods include various behavioral monitoring to mitigate the limitation, but they often suffer from compatibility issues due to their strong dependency on specific application features and high porting overhead across systems. Inspired by recent efforts on using storage system features for security, we explore a general framework that leverages generic storage system capabilities to help address the challenge of ransomware detection and recovery. Specifically, the framework includes an eBPF-based detector that aims to provide a cross-platform compatible I/O logger with a detection plane alongside a recovery mechanism that uses file system snapshots. Our preliminary results show that the framework can achieve the design goal with relatively low overhead.

## I. INTRODUCTION

Ransomware has evolved into one of the most disruptive forms of cybercrime, combining technical sophistication with aggressive extortion tactics that can paralyze organizations of any size. The Worldwide Ransomware 2024 report reported that known ransomware attacks rose from 2593 incidents in 2022 to 5289 in 2024, with the USA accounting for approximately half of all cases [8]. Ransomware attackers received $813.55 million from victims in 2024 [1]. Governments, critical infrastructure operators, healthcare providers, and small businesses now face a threat that can halt operations, compromise sensitive data, and generate cascading economic and societal harm.

Traditional detection mechanisms often struggle to keep up with the evolving tactics used by attacks. Existing methods like static analysis are only so effective and can be circumvented by newer techniques like polymorphic code and encrypted payload, and so it is crucial to develop new ways to protect data from such attacks. Additionally, new solutions often reinvent the wheel, implementing the same method using a variety of technologies, when such solutions have already been implemented.

Inspired by recent efforts on using storage system capabilities (e.g., computational storage devices [14]) for security, we explore a general framework that leverages storage system features in this paper. Our solution introduces the SayCheese framework that can be integrated with existing solutions to collect I/O heuristics and recover encrypted files present on a copy-on-write (CoW) file system. Our solution utilizes eBPF to collect I/O heuristics, aiming to reduce overhead and customization of the kernel in order to run efficient solutions. Integrating SayCheese into existing solutions allows us to focus on more important topics like ransomware classification.

## II. BACKGROUND & RELATED WORKS

### A. Ransomware

Ransomware is a type of malicious software that prevents users from accessing their data (often in the forms of files) and systems, demanding a ransom. It is a practical threat that has caused billions of dollars worth of damages to various victims. Ransomware can be classified based on the actions it performs. The main categories include the following:

* **Encryptors:** Encrypts all the data within a system making them inaccessible without a decryption key. Notable ransomware includes CryptoLocker, Cerber, and Bad Rabbit.

* **Lockers:** Locks the user out of the system and displays the ransom demand on the lockscreen.

* **Scareware:** Mimics actual ransomware without actually damaging files. Examples include SpySheriff, ErrorSafe, and DriveCleaner.

* **Doxware:** Threatens to distribute sensitive information online. Includes Maze, REvil and LockBit.

### B. Related Work

Previous ransomware detection solutions have used various methods to detect ransomware and recover from its effects. Technologies such as FUSE and kernel modules are used to collect various metrics that are fed into a machine learning model to identify if ransomware is present on the system or not. While effective for their original design goals, they are
insufficient to address the ransomware challenge in practice
due to the lack of generality and high porting overhead. We
elaborate on a few representative works below.

Kharraz et al. published Redemption [11], which uses a
lightweight Windows kernel module to intercept process inter-
actions, store events, and manage changes in a protected area.
It assigns a malicious score based on behavior- and content-
based features. However, they incur an overhead of 2.8%
and 3.4% for reads and writes, respectively, and 7% and 9%
for rewrite and create operations, respectively. Additionally,
the authors state that the solution may not be suitable for
workloads involving many small files.

Continella et al. developed ShieldFS [9] to monitor the file
system to detect malicious behavior on the system using the
Windows minifilter driver. They proposed the concept of ticks,
which is the percentage of files accessed to invoke various
levels of classifiers. However, ShieldFS is specific to Windows
and would require a significant effort to port to other systems.

Assan et al. proposed GuardFS [16], a userspace file system built on FUSE, a Linux userspace file system driver, to implement their own file system that intercepts I/O operations on the fly and prevents ransomware from directly modifying files. They also attempt to obfuscate responses by intercepting system calls and preventing malicious calls from being executed on actual data. However, such features come with high maintenance or high overhead cost.

Wang et al. studied ransomware and published DeftPunk [17], which obtains block-level I/O traces and employs a two-layer classifier to detect ransomware operations on the system. It also implements snapshots and creates pre- and post-attack snapshots to record all modifications made during the attack and roll back the changes. However, snapshots incur some overhead and could be mitigated by using copy-on-write snapshots.

Long et al. developed RanAway [12] which uses Microsoft's Resilient File System (ReFS) to collect I/O heuristics and uses an algorithm to detect ransomware operations on the system. It also utilizes ReFS's volume snapshot and block cloning features to recover affected files.

Most recently, Shi et al. [14] proposes to revisiting com-
putational storage devices (CSD) for improving data integrity
and security, including fault tolerance testing [10], [13], [18],
erasure coding, and ransomware detection and recovery. While
their ideas look promising, it is closely tied to the CSD
devices. Partially inspired by the CSD-level efforts, we explore
storage software features for security in this work.

III. RANSOMWARE DETECTION AND RECOVERY WITH STORAGE SYSTEM FEATURES

A. *Key Observations*

In this section, we identify the main limitations of the state-
of-the-art solutions and discuss relevant features of storage
systems that can be leveraged to address the ransomware
challenge.

1) **Ransomware Detection:** Existing solutions like [17], [9], and [11] use kernel modules and minifilter drivers to collect I/O heuristics from the system. Other solutions like [16], [15] use FUSE to do the same. These solutions show that fine-grained file system telemetry is effective for detecting ransomware activity but are limited to their own platforms and are not cross-platform compatible. Linux features like FUSE have high overhead due to additional context switching and data copying between user and kernel space.

**eBPF for Detection:** Extended Berkeley Packet Filter (eBPF) is a kernel technology that can run sandboxed programs within a privileged context. It is used to safely and efficiently extend the capabilities of the kernel without requiring any changes to the kernel source or additional kernel modules. eBPF programs are event-driven and run when the kernel or application passes a certain hook point. Hooks include system calls, function entry/exit, kernel tracepoints, network events, and several others. eBPF programs can be loaded into the kernel using the `bpf()` system call. eBPF programs are initially validated by the eBPF verifier, which ensures that the program meets several conditions such as:

* The process loading the eBPF program holds required privileges.

* The program does not crash or harm the system.

* The program always runs to completion.

One advantage of eBPF is that it is cross platform. With eBPF for Windows being developed, this solution can be utilized across multiple platforms to reduce overhead costs and development efforts. With this cross-platform support, eBPF can be leveraged to build a generic solution to collect I/O heuristics. Moreover, eBPF has significantly less overhead than technologies like FUSE, and unlike kernel modules, are statically verified by the eBPF verifier and run within a sandbox, making the solution more resistant to bugs.

2) **Ransomware Recovery.**: Current methods such as [17] do not take advantage of file system features for recovery and create their own method to take snapshots. Other solutions like [9] copy the file to a read-only storage to recover the files once the ransomware has been dealt with. Traditional solutions rely on backup infrastructures, which typically operate at the volume or system level and are optimized for periodic full or incremental backups. Full backups provide strong guarantees, but are expensive in both time and storage and may require the protected storage to be taken offline or put into a special backup mode. For organizations that already struggle with the frequency and completeness of backups, additional snapshot layers can further increase the operational burden. This is particularly problematic given that ransomware incidents continue to rise and recovery time objectives are shrinking. These solutions add overhead and may not support all systems.

**Snapshot for Recovery:** Snapshots are a side effect of *copy-on-write* (CoW) file systems. CoW file systems work by creating a new copy of the data only when changes occur, while preserving the original copy of the data. This approach improves reliability in cases such as unexpected power loss
or crashes. Preserving the original data allows for features like snapshots, which are a read-only copy of the file system at a particular point in time. Snapshots are created almost immediately and allow users to quickly roll back to a previous state. File systems like Btrfs and ZFS support snapshots due to their CoW nature.

<figure><img src="image_2.png" /><figcaption>Fig. 1: Working of snapshots in CoW file systems</figcaption></figure>

Fig. 1 shows how snapshots work on CoW file systems. The blue and yellow nodes represent the data in the file system. The file system maintains pointers to the old and the new nodes, while the snapshot maintains pointers to the old nodes only. In this way, we can always rollback in the event of corruption or failure

We notice that CoW features are present on all file system platforms [7], [2], [6], [4] which allow snapshotting of files/volumes. Since snapshotting is an inherent feature of CoW, data present in the file before encryption/deletion by ransomware can be restored without much overhead. Coupled with full backups, This theoretically reduces the overhead incurred by other solutions.

## B. Preliminary Prototype

Based on the key observations discussed above (§III-A), we proposed a generic framework called SayCheese for ransomware detection and recovery. As shown in Figure 2, the framework is composed of two parts: the eBPF detection module and the snapshot module.

We propose a library that utilizes eBPF to trace and collect system calls from the system. We trace system calls such as write, read, create, open, rename, and unlink, along with their parameters and return values. We also collect additional

<figure><img src="image_3.png" /><figcaption>Fig. 2: Design Overview</figcaption></figure>

information such as timestamp, PID, and PPID. An example signature entry is as follows:

<Timestamp, Program Name, PID, PPID, Operation, Syscall, Syscall Arguments>

Capturing the timestamp allows the system to reconstruct an exact timeline of file operations, which can then be used to take and roll back snapshots as desired. Recording PID and PPID binds each event to its process, allowing users to track suspicious processes.

For the proof-of-concept implementation, we utilize libbpf to write the eBPF I/O logger. We attach functions to various trace points that collect the previously mentioned metrics and push them to userspace via a ring buffer, which means the order of the events are preserved in the order in which the syscalls occur. The user can provide a handler to the library to process signature entries. The eBPF program and userspace library can be bundled as one binary. Fig. 2 shows the architecture of the I/O logger.

To complement the real-time tracing of file changes, we propose using file system snapshots to restore files affected by ransomware attacks. We develop a library to interface with file system snapshotting APIs. We currently provide two APIs: `create_snapshot()` and `restore_snapshot()`. The user specifies the snapshot storage path and the maximum number of snapshots to store at a time. For proof-of-concept, we implement the library in Python and support BTRFS and ZFS file systems. Both BTRFS and ZFS can create snapshots nearly instantaneously and provide python libraries to interface with. Existing solutions like DeftPunk could utilize this library to take snapshots of the file system instead of developing their own solution. Although BTRFS and ZFS are supported first, the library is designed to be extensible to other file systems that support CoW and provide APIs to interface it.

## C. Preliminary Results & Discussion

1) eBPF Program Limitations: Although eBPF provides a powerful and relatively safe mechanism for kernel syscall
monitoring, it also exposes various maps and ring buffers associated with it, which make it easy for any process with appropriate capabilities to view and modify the state of eBPF programs and their maps. However, this can be mitigated by restricting the processes that can invoke privileged `bpf()` operations. This attack can also be restricted through various existing security modules such as AppArmor and SELinux.

Some important heuristics such as Shannon entropy cannot be calculated since eBPF programs are restricted from performing math operations like log. Additionally, eBPF program buffers require a fixed size array at compile time and therefore cannot send the read/write buffer to userspace for entropy calculation.

2) *Cross-Platform Support:* While the PoC implementation was built for Linux, it can be run on Windows with minor modifications with Windows supporting eBPF [3] and it's file system ReFS supporting CoW. The main change would be to integrate Windows' snapshotting utility [5] into our snapshotting library and to modify any eBPF APIs that differ from Windows.

3) *Snapshots vs. Backups:* Snapshotting requires the underlying file system to support CoW. Due to this, snapshotting is quick and can be used as a part of the recovery strategy. In contrast, backups are slow. However, snapshotting is not foolproof and ransomware can often detect and encrypt snapshots as well, causing the recovery strategy to fail. Therefore, it is recommended to take full backups, albeit at a lesser frequency, and use snapshots to augment backups.

## IV. CONCLUSION

This position paper presents a ransomware defense framework that couples low-overhead I/O heuristic logging, implemented as an eBPF-based library, with transparent recovery using file system snapshotting. By packaging the monitoring logic as a reusable library rather than a monolithic application, the framework can be integrated into both existing and newly developed solutions with minimal modification to their codebases. The SayCheese framework is designed to be non-intrusive: it operates at the operating system level, passively observing file I/O patterns without requiring changes to applications, file systems, or kernel source. Leveraging eBPF's portability across modern Linux kernels, SayCheese targets a cross-platform deployment model in which the same core logic can be reused across distributions and environments, while still maintaining minimal runtime overhead suitable for latency-sensitive workloads. However, SayCheese inherits several limitations from the underlying eBPF model. As discussed in eBPF program limitations, current constraints include a medium surface attack and the lack of entropy-based heuristics which are commonly used in ransomware detection to identify suspiciously high-entropy write patterns indicative of encryption activity. Future work includes exploring hybrid designs that offload entropy computation and more advanced content-aware heuristics to userspace while retaining eBPF for efficient event collection, as well as hardening the framework against management-plane attacks on BPF programs and maps.

## REFERENCES

[1] 5 Most Common Types of Ransomware | CrowdStrike.

[2] https://btrfs.readthedocs.io/en/latest/introduction.html.

[3] https://github.com/microsoft/ebpf-for-windows.

[4] https://github.com/openzfs/zfs.

[5] https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/refsutil-streamsnAPSHOT.

[6] https://learn.microsoft.com/en-us/windows-server/storage/refs/refs-overview.

[7] https://support.apple.com/en-gb/guide/security/seca6147599e/web.

[8] Worldwide Ransomware, 2024.

[9] Andrea Continella, Alessandro Guagnelli, Giovanni Zingaro, Giulio De Pasquale, Alessandro Barenghi, Stefano Zanero, and Federico Maggi. Shieldsfs: a self-healing, ransomware-aware filesystem. In *Proceedings of the 32nd annual conference on computer security applications*, pages 336–347, 2016.

[10] Om Rameshwar Gatla, Muhammad Hameed, Mai Zheng, Viacheslav Dubeyko, Adam Manzanares, Filip Blagojević, Cyril Guyot, and Robert Mateescu. Towards Robust File System Checkers. In *16th USENIX Conference on File and Storage Technologies (FAST)*, 2018.

[11] Amin Kharraz and Engin Kirda. Redemption: Real-time protection against ransomware at end-hosts. In *Research in Attacks, Intrusions, and Defenses: 20th International Symposium, RAID 2017, Atlanta, GA, USA, September 18–20, 2017, Proceedings*, pages 98–119. Springer, 2017.

[12] Jinting Long and Hua Liang. RanAway: A Novel Ransomware-Resilient ReFS File System, February 2024. ISSN: 2693-5015.

[13] Tabassum Mahmud, Om Rameshwar Gatla, Duo Zhang, Carson Love, Ryan Bumann, and Mai Zheng. ConfD: Analyzing Configuration Dependencies of File Systems for Fun and Profit. In *21st USENIX Conference on File and Storage Technologies (FAST)*, 2023.

[14] Chao Shi, Anthony Manschula, Tabassum Mahmud, Zeren Yang, Mai Zheng, Yong Chen, Jim Wayda, Matthew Wolf, and Byungwoo Bang. Revisiting computational storage for data integrity and security, 2025.

[15] Jan von der Assen, Alberto Huertas Celdrán, Rinor Sefa, Burkhard Stiller, and Gérôme Bovet. Mtfs: a moving target defense-enabled file system for malware mitigation. In *2024 IEEE 49th Conference on Local Computer Networks (LCN)*, page 1–6, October 2024.

[16] Jan von der Assen, Chao Feng, Alberto Huertas Celdrán, Róbert Oleš, Gérôme Bovet, and Burkhard Stiller. Guardfs: A file system for integrated detection and mitigation of linux-based ransomware. *arXiv preprint arXiv:2401.17917*, 2024.

[17] Zhongyu Wang, Yaheng Song, Erci Xu, Haonan Wu, Guangxun Tong, Shizhuo Sun, Haoran Li, Jincheng Liu, Lijun Ding, Rong Liu, Jiaji Zhu, and Jiesheng Wu. Ransom access memories: achieving practical ransomware protection in cloud with deftpunk. In *Proceedings of the 18th USENIX Conference on Operating Systems Design and Implementation, OSDI’24*, page 687–702, USA, July 2024. USENIX Association.

[18] Mai Zheng, Duo Zhang, and Ahmed Dajani. On fault tolerance of data storage systems: A holistic perspective. In *Ruba Mircea and Gabriel Chindris, editors, Fault Tolerance in Modern Engineering Systems*, chapter 3. IntechOpen, London, 2025.