A moving-target-defense architecture for protecting against ransomware and data exfiltration

Abstract Exfiltration and ransomware attacks have increased dramatically in the Middle East, particularly targeting major institutions in Saudi Arabia and Qatar. These sophisticated attacks are executed by info-seekers who meticulously gather intelligence on potential targets before launching their attacks. These attacks often target cloud environments and storage systems, as their centralized architecture makes them vulnerable to insider threats, unauthorized access by cloud providers and governments, and large-scale breaches. To address these challenges, this research presents a novel Resilient Distributed File Storage (RDFS) system that combines Moving Target Defense (MTD) with Random Linear Network Coding (RLNC) to enhance protection against these evolving threats while ensuring data privacy through decentralization. The system achieves security through architectural design, implementing file fragmentation with strategic distribution, dynamic chunk shuffling, extension hiding, and name padding techniques to complicate attacks. The proposed system is evaluated through three complementary methods: an information-theoretic entropy analysis of confidentiality, an analytical integrity model that incorporates replication, and a virtualised four-agent prototype implemented in GNS3 over VMware. Security assessment via entropy analysis validates enhanced confidentiality, while redundancy mechanisms improve integrity with up to an eight-fold gain over the no-redundancy baseline; the prototype confirms that RLNC adds only 2.0– $$3.7\%$$ packet overhead while reducing average packet loss from $$22.3\%$$ to $$13.5\%$$ at 10 MB and lowering average round-trip time by up to $$37\%$$ . Under the modeled attacker, MTD chunk shuffling intervals can be configured to remain below the theoretical attack execution times, raising the cost and reducing the effective time window of unauthorized access attempts. By distributing data across multiple independent storage clouds, the system prevents any single entity, including cloud providers and malicious insiders, from trivially reconstructing complete files. The RDFS system therefore offers robust protection against modern cyber threats while maintaining data privacy and availability.