# Ransomware-Resilient Self-Healing XML Documents
## 2 Background
### Version-Control System (VCS)  
Version-control systems (VCS) are used to manage all changes made to documents, including tracking and storing version data. In this paper, VCS will be tapped into by presenting a novel approach to recovering XML documents affected when Ransomware attacks victims' machines, causing locking of file encryption. Version-Aware XML-based documents is a distributed version-control system that does not rely on a central repository but refers to the document file to utilize the changes between different versions of the same document. version-control is a system used for tracking all files or file set changes over time to allow for the subsequent release of a specific version of the file so that you can obtain a specific version of the file later. As VCS became popular, new techniques continued to evolve. It uses two main techniques to store versions of data. The first one is to keep a copy of each new version of the file, while the second one would keep only the deltas, which are the data differences between the two versions of the file. There are two major version-control types: centralized and distributed. A centralized version-control system is based on client-server architecture where a central repository is used to store the document versions. Centralized VCS must be used online as it requires the end-user (client) to be connected to the system (central repository) at all times. Using this approach makes it possible to elicit single points of failure [22].  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Category** & **Symptoms** & **Example** \\ \hline \multirow{2}{*}{Locker} & \multirow{2}{*}{prevents users from accessing their files and data} & W32. [PERSON] \\  & & Data \\ \hline \multirow{4}{*}{Crypto} & Encrypts victims’ files, file contents, and file names without notification by utilizing different cryptographic methods & \\  & and notifies victims that their data have been encrypted, forcing them to pay a ransom to decrypt files. & \\ \hline \multirow{2}{*}{Double} & Encrypts files and asks victims to pay a ransom. & \\  & Attackers threaten to publicize stolen data if their & \\ \multirow{2}{*}{Ratio} & demands are not met. & \\  & & \\ \hline \multirow{2}{*}{Ratio} & Involes perpetrators leasing access to ransomware & \\  & from the ransomware author, who delivers it as a paid service. & Locky \\ \hline \hline \end{tabular}
\end{table}
Table 1: Ransomware Categories.  
A distributed version-control system, also known as Version-Aware XML document (used in our approach) was first introduced in [22]. In contrast to centralized VCS, version-aware VCS does not depend on a central repository to store versions data. It utilizes reverse deltas stored inside the document file itself, which are the data differences between the two versions of a file, rather than storing the whole document every time. By using Version-Aware XML document technology, users are not worried about the need to use a repository or network connection to remote servers. LibreOffice documents (ODT) are XML schemas that store files, styles, and settings. The authors of [23] created a Custom Microsoft Word plugin to support Version-Aware XML documents technology. Revisions of the document content are stored as a separate copy (snapshot) in a sub-directory inside the document. [PERSON] et al. [24; 25] proposed a secure framework for XML documents that improves security for XML documents and their provenance and provides persistent integrity, detects tampering, and provides tools for performing forensics by utilizing version-aware XML document technology. Their approach provides an extensive document history with author signatures at each step, which also enhances the performance when applying security policies applied to documents.