Convolutional Neural Network-Based Cryptography Ransomware Detection for Low-End Embedded Processors

Hyunji Kim,Hwajeong Seo,Kyoungbae Jang,Hyeokdong Kwon,Jaehoon Park

doi:10.3390/math9070705

Abstract

A crypto-ransomware has the process to encrypt victim’s files. Afterward, the crypto-ransomware requests a ransom for the password of encrypted files to victims. In this paper, we present a novel approach to prevent crypto-ransomware by detecting block cipher algorithms for Internet of Things (IoT) platforms. We extract the sequence and frequency characteristics from the opcode of binary files for the 8-bit Alf and Vegard’s RISC (AVR) processor microcontroller. In other words, the late fusion method is used to extract two features from one source data, learn through each network, and integrate them. We classify the crypto-ransomware virus or harmless software through the proposed method. The general software from AVR packages and block cipher implementations written in C language from lightweight block cipher library (i.e., Fair Evaluation of Lightweight Cryptographic Systems (FELICS)) are trained through the deep learning network and evaluated. The general software and block cipher algorithms are successfully classified by training functions in binary files. Furthermore, we detect binary codes that encrypt a file using block ciphers. The detection rate is evaluated in terms of F-measure, which is the harmonic mean of precision and recall. The proposed method not only achieved 97% detection success rate for crypto-ransomware but also achieved 80% success rate in classification for each lightweight cryptographic algorithm and benign firmware. In addition, the success rate in classification for Substitution-Permutation-Network (SPN) structure, Addition-Rotation-eXclusive-or structures (ARX) structure, and benign firmware is 95%.

Highlights

In 2017, users of Microsoft Windows were infected by Wannacry ransomware virus, since the file sharing protocol has the the vulnerability [1]
The proposed method achieved 97% detection success rate for crypto-ransomware and achieved 80% success rate in classification for each lightweight cryptographic algorithm and benign firmware
Since the encryption is performed unlike benign firmware when the crypto ransomware runs, the encryption process is set as a characteristic of ransomware

Summary

Introduction

In 2017, users of Microsoft Windows were infected by Wannacry ransomware virus, since the file sharing protocol has the the vulnerability [1]. It is the biggest attack in the history of ransomware, with more than 200,000 computers affected. There are two categories of ransomware, including cryptography type or locker type. Since the locker type locks the target machine, it can no longer be accessible by users [2]. The data can be copied to other devices, and the data can be recovered because the data is not fully encrypted. Files of devices are encrypted by the cryptography ransomware

Methods

Results

Conclusion