ShieldFS: In recent months, successive waves of ransomware attacks have hit the internet globally, halting the operation of businesses and vital infrastructure from hospitals to telecommunications.
So the research by Andrea Continella and his team is quite timely: A tool that detects ransomware automatically, almost instantly, and restores your system from backups before the crooks lock it down completely. 
The tool is called ShieldFS, and it's not designed as a broad antivirus platform. Instead, it only scans for ransomware attacks.
The new project reportedly focuses solely on identifying the unique cryptographic behaviors of ransomware, which allows ShieldFS to detect not only known types of malware, but also any new attacks that act in a ransomware manner.
The team, from Politecnico di Milano in Italy, will present ShieldFS at the Black Hat taking place in Las Vegas on Wednesday.
“We have developed a set of indicators that can be used to very effectively clarify whether a process is ransomware or a benign process,” says Stefano Zanero, a security researcher who worked on the project.
By focusing on detecting encryption itself, rather than simply cataloging specific ransomware types, ShieldFS can prevent both known and unknown ransomware.
The researchers tested common ransomware types, such as CryptoLocker and TeslaCrypt, which attack a system in the typical way – scanning the disk and encrypting every file. At Black Hat, the team is preparing to present the ShieldFS tool’s defense against WannaCry, the ransomware that hit thousands of computers in May.
When the tool detects a suspicious new program, it enters an observation phase to determine whether that program is ransomware or not.
During this period, which researchers call “shadowing,” ShieldFS begins to keep a log of everything the intruder does and every file it accesses.
If the application concludes that the program is malicious, it will prevent file encryption and automatically restore all files infected by the ransomware from extensive backups. In the event that ShieldFS detects something wrong (false positive), according to the researchers, it will not cause collateral damage.
