New ‘SHIELD’ Platform Leverages FPGA and Off-Host Monitoring to Tackle Advanced Ransomware Threats

In a significant advancement against increasingly sophisticated ransomware threats, researchers from NYU Tandon School of Engineering have introduced SHIELD (Secure Host-Independent Extensible Logging), an innovative detection architecture.

This system leverages hardware-level, tamper-proof metrics for real-time ransomware identification.

By operating independently of compromised host systems, SHIELD addresses a critical gap in existing detection frameworks, offering unparalleled security against ransomware’s rapid and covert encryption techniques.

Revolutionizing Ransomware Detection Through Hardware Isolation

SHIELD integrates FPGA-based open-source SATA and Network Block Device (NBD) technologies to achieve hardware-level isolation.

Unlike traditional methods reliant on host systems prone to tampering, SHIELD collects and analyzes metrics directly at multiple hardware layers, including the SATA interface, FPGA, and the EXT4 file system.

This robust framework allows it to observe and analyze nuanced storage activity in real-time, distinguishing between benign and malicious software.

Researchers conducted comprehensive case studies involving 10 ransomware families and 10 benign software applications.

SHIELD successfully identified key behavioral differences linked to ransomware, such as unusually high inode and data block access rates during encryption processes.

For instance, variants like LockBit and BlackCat capable of encrypting tens of thousands of files per minute were effectively detected due to SHIELD’s detailed metric capture capabilities.

Capabilities

The SHIELD system offers three major innovations:

1. Multi-Level Tamper-Proof Metrics: By collecting intricate data at various hardware levels, SHIELD enables real-time anomaly detection without relying on vulnerable host systems.
2. Enhanced FPGA-Based Storage Functionality: SHIELD expands the capabilities of an open-source SATA Host Bus Adapter (HBA) to support full disk operations, enabling seamless integration with NBD-based storage over Ethernet.
3. Foundational Support for Machine Learning (ML): The collected metrics lay the groundwork for ML-assisted automated detection, enabling future development of intelligent ASIC-based security mechanisms.

The architecture supports both physical SATA storage devices and virtual storage environments, ensuring scalability and compatibility with diverse operational needs.

SHIELD’s experimental results highlight its efficacy in identifying ransomware. The system’s hardware-level metrics, such as inode writes and data block reads, revealed stark differences between benign and ransomware programs.

Ransomware consistently showed higher inode modifications per second, a key indicator of malicious behavior.

Benign software exhibited stable disk access patterns, allowing SHIELD to uniquely fingerprint safe applications versus ransomware.

The study also demonstrated that SHIELD’s host-independent framework maintained accuracy while being impervious to tampering, a critical advantage over traditional host-dependent approaches.

Comparative analysis with existing ransomware detection methods underscores SHIELD’s superiority.

While traditional solutions like file integrity monitoring or cloud-based systems offer partial protections, they lack the granularity or host independence SHIELD provides.

Moreover, SHIELD’s ability to seamlessly integrate into on-site infrastructure addresses organizational concerns over data sovereignty and privacy.

Looking ahead, the researchers plan to integrate machine learning models for automated ransomware detection and mitigation.

Additionally, embedding SHIELD within specialized ASICs or storage controllers could deliver high-speed, low-latency malware detection directly within hardware.

Such advancements would position SHIELD as a cornerstone technology for secure data storage and ransomware defense.

Are you from SOC/DFIR Teams? – Analyse Malware Files & Links with ANY.RUN Sandox -> Try for Free