search

undo-ransomware / ransomware_detection

:arrows_counterclockwise: Ransomware recovery app for Nextcloud
https://apps.nextcloud.com/apps/ransomware_detection
GNU Affero General Public License v3.0
22 stars 6 forks source link

Settings: meaning unclear #37

Closed sm8ps closed 3 years ago

sm8ps commented 3 years ago

First off, thanks so much for making this app available! It is incredibly valuable to have some safety plan in addition to daily backups that one would have to dig through.

However, I do not really understand what the settings mean. I am wondering how to set sensible values for not so frequent users that may notice only after e.g. two weeks that their data has been attacked.

'Number of days until a sequence will be deleted' is set to 7 by default. Does that mean that a user has to react to a ransomware protection within seven days, otherwise the current state will be considered normal?

'Minimum number of file operations contained by a sequence, that it will be shown in recovery' is set to 5. What is the importance of such sequences in connection with recovery?

Hopefully these questions are extremely simple to answer with the necessary knowledge. As a simple user of this app, I do not see any other resource than asking here. Thanks in advance for some short explanation!

ilovemilk commented 3 years ago

Hi sm8ps,

thanks for asking! I'm currently reworking the application that it's easier to use.

Number of days until a sequence will be deleted: File operations older than the value e.g. 7 days will be deleted. After they are deleted it's impossible to recover via the application. The reason for this is that if you have many users performing may file operations the number of entries in your database can explode.

Minimum number of file operations contained by a sequence, that it will be shown in recovery: Ransomware encrypts as many as possible files. Normally, you have more the 5 files in your cloud so you will have more the 5 file operations in one sequence. So if you have like 100 files and a ransomware attack hits you most of the times there will be a sequence with a about 50 or more file operations. Hence this just filters sequences which likely will be no ransomware attack.

I hope this is understandable if not just ask! :) If you have a suggestion for a better description of these values I would be very thankful.

ilovemilk commented 3 years ago

I added this to the new readme. I hope this helps.

Closing this so far! :) If there are questions left just ask.

sm8ps commented 3 years ago

Thanks for taking up this issue!