Preventing Ransomware Damages Using in-Operation Off-Site Backup to Achieve a 10⁻⁸ False-Negative Miss-Detection Rate

This paper proposes a backup-based defense mechanism that transparently and continuously secures production data against ransomware while ensuring controlled growth of backup copies. Ransomware attacks continue to intensify, often bypassing conventional static or dynamic detection-based security measures and inflicting irreparable harm on critical organizational data. Our approach focuses on a “just-in-time” backup strategy—termed In-Operation Off-Site Backups—that interposes continuous and verifiable file duplication at each update, combined with a detection mechanism that can halt malicious encryption attempts as soon as they are discovered. The solution leverages Bloom filters and carefully managed linked-list backups to maintain a low false-negative miss detection rate on the order of 10<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">−8</sup>, providing extremely high confidence that unauthorized data modifications will be detected before damage spreads. By employing fake fields, locality-aware thresholds, and fine-tuned probabilistic data structures, the system discriminates malicious activities from legitimate ones, preventing denial-of-service threats associated with frequent backups. Simulation results demonstrate that this approach can achieve highly reliable detection and sustainable storage utilization. The proposed method fills a crucial gap in ransomware protection by ensuring that backups remain both secure and manageable, thereby mitigating the risk of catastrophic data loss.