Ransomware Detection Research Articles

Zero-Ran Sniff: A zero-day ransomware early detection method based on zero-shot learning

Ransomware attacks, which blackmail victims into paying a ransom by locking their devices or encrypting their files, have become one of the major threats to network security. Conventional anti-ransomware tools often fail to detect zero-day ransomware attacks due to the inability to obtain zero-day ransomware signatures in advance to train detection models. In addition, zero-day ransomware attacks often use sophisticated encryption techniques to launch attacks on new vulnerabilities, and these encryption attacks cause irreversible damage to victims' digital files even if they choose to pay a ransom. Hence, it is imperative and urgent to detect unknown ransomware attacks at the earliest possible stage, ideally before the encryption phase. To this end, this paper proposes Zero-Ran Sniff (ZRS), an early zero-day ransomware detection method based on zero-shot learning, which can detect zero-day ransomware attacks in the early stage. ZRS leverages the portable executable header (PE header) feature from executable files to identify ransomware. It comprises two stages: an auto-encoding network-based core attribute learning (AE-CAL) stage and a self-attentive mechanism-based convolutional neural network inference Stage (SA-CNN-IS). During the AE-CAL stage, the core features of known and unknown classes of ransomware are extracted using self-encoding networks, and the SA-CNN-IS phase identifies ransomware. To the best of our knowledge, we are the first to explore the use of zero-shot learning for zero-day ransomware early detection. Experimental results demonstrate that the proposed ZRS outperforms traditional machine learning methods. Compared to previous zero-day detection work, ZRS achieves a recall of 98.47% and an accuracy of 96.31%

Empowering Security with Machine Learning for Ransomware and Malware Detection

Due to the increase and frequency of network attacks, network security protection needs to be established[1]. The project focuses on using machine learning technology to detect ransomware and malware and aims to improve computer security. This work involves using advanced algorithms and models to analyze different types of data to identify patterns associated with crime. The proposed system extracts relevant features from various data points, including archive behavior, network traffic, and physical interactions. These features are used to train machine learning models to distinguish between good behavior and bad behavior. By constantly learning and updating, the model improves accuracy over time and stays ahead of evolving ransomware and malware threats. This project aims to contribute to the field of cybersecurity by providing efficient and effective methods to detect and mitigate threats. The use of machine learning-based search engines should improve defense against cyber attacks, ultimately protecting sensitive data and ensuring the integrity of computer systems[2]. This research aligns with the growing need for cybersecurity in response to new solutions to combat the evolution of malware. Key Words: Cybersecurity, Ransomware detection, Malware detection, Machine learning techniques, Advanced algorithms, Data analysis, Feature extraction, Model training, Continuous learning, Threat detection, Defence mechanisms

An Approach to Android Ransomware Detection Using Deep Learning

As mobile devices continue to grow in popularity, the threat of ransomware attacks on Android devices has escalated, leading to serious privacy and financial risks for users. Traditional methods of ransomware detection have become less effective due to the evolving nature of these attacks. Consequently, the application of deep learning techniques offers promising potential for the detection and prevention of Android ransomware. This paper proposes an approach that utilizes deep learning algorithms to analyze and identify ransomware behavior on Android devices, aiming to enhance the security measures against these malicious threats. The model we used is a feedforward neural network model using the Keras Sequential. The model consists of three layers of densely connected neurons. The first layer has 64 units, the second layer also has 64 units, and the third and final layer has 2 units. The proposed model gave accuracy 98.9%.

It's too late if exfiltrate: Early stage Android ransomware detection

Ransomware attacks disrupt and disable systems, demanding a ransom from the victim to restore functionality. Most of the state-of-the-art approaches focus on analyzing their behaviour at the post-infection, to identify ransomware and therefore, fails to detect at the early stage. This work proposes a ransomware detection mechanism named Weapon, to identify the threat at the pre-operational stage in Android system. Weapon extracts the key features from the behavioural characteristics (permissions and API calls) of the APK file and generates semantic features. Consequently, the MITRE ATT&CK framework is used to correlate with the semantic features to detect ransomware before its operational stage efficiently. The experimental results demonstrate that our approach could successfully identify 89.82% ransomware samples at the pre-operational stage.

Ransomware Detection Using Portable Executable Imports

In recent years, there has been a substantial surge in ransomware attacks, wreaking havoc on both organizations and individuals. These attacks, driven by the lure of profits, particularly with the widespread use of cryptocurrencies, have prompted attackers to continuously develop innovative evasion techniques and obfuscation tactics to avoid detection. Ransomware, employing seemingly benign functions such as encryption and file-locking, poses a formidable challenge for detection as it evolves beyond traditional signature-based methods. Consequently, there is a growing need to identify previously unexplored and unstudied ransomware strains, necessitating the deployment of artificial intelligence (AI) to discern the unique characteristics and objectives of ransomware. The adoption of AI hinges on the prior selection of distinguishing features. Given that ransomware's intent fundamentally differs from that of benign files, there are variations in the structure of Portable Executables (PE) files. This study posits that the imports used by PE files can serve as a discriminating factor between ransomware and benign files. This research explored using machine learning models to detect ransomware by analysing and deriving insights from the PE Imports structure. To achieve this, the study trains seven machine learning classifiers, namely Random Forest, Logistic Regression, Naïve Bayes, Support Vector Machine, K-Nearest Neighbors, Gradient Boost, and Decision Tree. These models are trained on a dataset of carefully selected features derived from PE imports. The classifiers are benchmarked and ranked based on several evaluation metrics, including latency, accuracy, and confidence levels. For a model to be effective in ransomware detection, it should offer near real-time and highly confident accuracy. In other words, it should exhibit low latency, high accuracy, and strong AUC rates. Among the models, Logistic Regression emerges as the top performer, identifying ransomware programs with an impressive 98.5% accuracy and a confidence level of 98.6% within a mere 0.998-millisecond latency. This study conclusively affirms the efficacy of employing PE imports for ransomware detection.

A Study on Countermeasures against Neutralizing Technology: Encoding Algorithm-Based Ransomware Detection Methods Using Machine Learning

Ransomware, which emerged in 1989, has evolved to the present in numerous variants and new forms. For this reason, serious damage caused by ransomware has occurred not only within our country but around the world, and, according to the analysis of ransomware trends, ransomware poses an ongoing and significant threat, with major damage expected to continue to occur in the future. To address this problem, various approaches to detect ransomware have been explored, with a recent focus on file entropy estimation methods. These methods exploit the characteristic increase in file entropy that is caused by ransomware encryption. In response, a method was developed to neutralize entropy-based ransomware detection technology by manipulating entropy using encoding methods from the attacker’s perspective. Consequently, from the defender’s standpoint, countermeasures are essential to minimize the damage caused by ransomware. Therefore, this article proposes a methodology that utilizes diverse machine learning models such as K-Nearest Neighbors (KNN), logistic regression, decision tree, random forest, gradient boosting, support vector machine (SVM), and multi-layer perception (MLP) to detect files infected with ransomware. The experimental results demonstrate empirically that files infected with ransomware can be detected with approximately 98% accuracy, and the results of this research are expected to provide valuable information for developing countermeasures against various ransomware detection technologies.

EMIFS: A Normalized Hyperbolic Ransomware Deterrence Model Yielding Greater Accuracy and Overall Performance.

Early detection of ransomware attacks is critical for minimizing the potential damage caused by these malicious attacks. Feature selection plays a significant role in the development of an efficient and accurate ransomware early detection model. In this paper, we propose an enhanced Mutual Information Feature Selection (eMIFS) technique that incorporates a normalized hyperbolic function for ransomware early detection models. The normalized hyperbolic function is utilized to address the challenge of perceiving common characteristics among features, particularly when there are insufficient attack patterns contained in the dataset. The Term Frequency-Inverse Document Frequency (TF-IDF) was used to represent the features in numerical form, making it ready for the feature selection and modeling. By integrating the normalized hyperbolic function, we improve the estimation of redundancy coefficients and effectively adapt the MIFS technique for early ransomware detection, i.e., before encryption takes place. Our proposed method, eMIFS, involves evaluating candidate features individually using the hyperbolic tangent function (tanh), which provides a suitable representation of the features' relevance and redundancy. Our approach enhances the performance of existing MIFS techniques by considering the individual characteristics of features rather than relying solely on their collective properties. The experimental evaluation of the eMIFS method demonstrates its efficacy in detecting ransomware attacks at an early stage, providing a more robust and accurate ransomware detection model compared to traditional MIFS techniques. Moreover, our results indicate that the integration of the normalized hyperbolic function significantly improves the feature selection process and ultimately enhances ransomware early detection performance.

Real-time system call-based ransomware detection

Ransomware, particularly crypto ransomware, has emerged as the go-to malware for threat actors aiming to compromise data on Android devices as well as in general. In this paper, we present a ransomware detection technique based on behaviours observed in the system calls performed by the malware. We first describe our repeatable and extensible methodology for extracting the system call log and patterns. We then identify and present some common high-level system call behavioural patterns exhibited by crypto ransomware, and evaluate these patterns. We further describe the implementation of a streaming implementation that utilises regular expressions for modelling malware behaviours and finite state machines for detecting crypto ransomware behaviours in real time. The success of our proof of concept evaluation allows us to envision our proposed technique applied as part of a self-protection system on Android phones against malware.

Visualizing Portable Executable Headers for Ransomware Detection: A Deep Learning-Based Approach

In recent years, the rapid evolution of ransomware has led to the development of numerous techniques designed to evade traditional malware detection methods. To address this issue, a novel approach is proposed in this study, leveraging machine learning to encode critical information from Portable Executable (PE) headers into visual representations of ransomware samples. The proposed method selects highly impactful features for data sample classification and encodes them as images based on predefined color rules. A deep learning model named peIRCECon (PE Header-Image-based Ransomware Classification Ensemble with Concatenating) is also developed by integrating prominent architectures, such as VGG16 and ResNet50, and incorporating the concatenating method to enhance ransomware detection and classification performance. Experimental results using self-collected datasets demonstrate the efficacy of this approach, achieving high accuracy of 99.85% in distinguishing between ransomware and benign samples. This promising approach holds the potential to significantly improve the effectiveness of ransomware detection and classification, thereby contributing to more robust cybersecurity defense systems. 

Entropy Sharing in Ransomware: Bypassing Entropy-Based Detection of Cryptographic Operations.

This study presents a groundbreaking approach to the ever-evolving challenge of ransomware detection. A lot of detection methods predominantly rely on pinpointing high-entropy blocks, which is a hallmark of the encryption techniques commonly employed in ransomware. These blocks, typically difficult to recover, serve as key indicators of malicious activity. So far, many neutralization techniques have been introduced so that ransomware utilizing standard encryption can effectively bypass these entropy-based detection systems. However, these have limited capabilities or require relatively high computational costs. To address these problems, we introduce a new concept entropy sharing. This method can be seamlessly integrated with every type of cryptographic algorithm and is also composed of lightweight operations, masking the high-entropy blocks undetectable. In addition, the proposed method cannot be easily nullified, contrary to simple encoding methods, without knowing the order of shares. Our findings demonstrate that entropy sharing can effectively bypass entropy-based detection systems. Ransomware utilizing such attack methods can cause significant damage, as they are difficult to detect through conventional detection methods.

Early Detection of Windows Cryptographic Ransomware Based on Pre-Attack API Calls Features and Machine Learning

Ransomware attacks are currently one of cybersecurity's greatest and most alluring threats. Antivirus software is frequently ineffective against zero-day malware and ransomware attacks; consequently, significant network infections could result in substantial data loss. Such attacks are also becoming more dynamic and capable of altering their signatures, resulting in a race to the bottom regarding weaponry. Cryptographic ransomware exploits crypto-viral extortion techniques. The malware encrypts the victim's data and demands payment in exchange. The attacker would release the data decryption key after accepting payment. After data encryption, the user has two options: pay the ransom or lose the data. Cryptographic ransomware causes damage that is nearly impossible to undo. Detection at an early stage of a ransomware attack's lifecycle is vital for preventing unintended consequences for the victim. Most ransomware detection technologies concentrate on detection during encryption and post-attack stages. Due to the absence of early behaviour signs, it is challenging to detect ransomware before it begins the unwanted process of mass file encryption. This study examines the relationship between API calls pattern and their nature to determine whether it is ransomware early behaviour. The purpose of this paper is to determine whether this technique can be used to early detect the presence of ransomware activity on a Windows endpoint. 582 ransomware samples that consist of ten ransomware families and 942 benign software samples were analysed. This study proposed RENTAKA, a novel framework for the early detection of cryptographic ransomware. It makes use of characteristics acquired from ransomware behaviour and machine learning. This study presented an algorithm to generate a ransomware pre-encryption dataset. This study, which includes six machine-learning models, gives satisfactory results in detecting cryptographic ransomware. The features used in this research were among the 232 features identified in Windows API calls. Five standard machine learning classifiers were employed in this experiment: Naive Bayes, k-nearest neighbours (kNN), Support Vector Machines (SVM), Random Forest, and J48. In our tests, SVM fared the best, with an accuracy rate of 93.8% and an area under the curve (AUC) of 0.979, respectively. The results indicate that we can distinguish ransomware from benign applications with low false-positive and false-negative rates.

XRan: Explainable deep learning-based ransomware detection using dynamic analysis

Recently, the frequency and complexity of ransomware attacks have been increasing steadily, posing significant threats to individuals and organizations alike. While traditional signature-based antiransomware systems are effective in the detection of known threats, they struggle to identify new ransomware samples. To address this limitation, many researchers have focused on analyzing the behavior and actions of executables. During this dynamic analysis process, various dynamic-based features emerge, offering different perspectives on the executable's behavior, including Application Program Interface (API) call sequences, dynamic link libraries (DLLs), and mutual exclusions. Existing methods mostly perform machine or deep learning models for feature engineering and detection. These methods usually perform learning according to a single perspective or by combining data from different perspectives into the frequency domain. In this case, they may ignore the information from the other aspects or the sequence relationship between the features. In addition, learning models used in these solutions are mostly incomprehensible to humans, which could be an obstacle in terms of having an insight through the model's mentality and also ransomware's way of work. In this study, we provide XRan (eXplainable deep learning-based RANsomware detection using dynamic analysis), an Explainable Artificial Intelligence (XAI) supported ransomware detection system that combines different dynamic analysis-based sequences, each representing a different view of the executable, in order to enrich the feature space. XRan employs a Convolutional Neural Network (CNN) architecture to detect ransomware and two XAI models as Interpretable Model-Agnostic Explanations (LIME), and SHapley Additive exPlanations (SHAP) to provide local and global explanations for detection. Experimental results demonstrate that XRan provides up to 99.4% True Positive Rate (TPR), and outperforms the state-of-the-art methods.

Hypervisor-Level Ransomware Detection in Cloud Using Machine Learning

Ransomware attack incidences have been on the rise for a few years. The attacks have evolved over the years. The severity of these attacks has only increased in the cloud era. This article discusses the evolution of ransomware attacks targeting cloud storage and explores existing ransomware detection solutions. It also presents a methodology for generating a dataset for detecting ransomware in the cloud and discusses the results, including feature selection and normalization. The article proposes a system for detecting attacks in virtualized environments using machine learning models and evaluates the performance of different classification models. The proposed system is shown to have high accuracy of 96.6% in detecting ransomware attacks in virtualized environments at the hypervisor level.

A fine-tuning of decision tree classifier for ransomware detection based on memory data

Ransomware has evolved into a pervasive and extremely disruptive cybersecurity threat, causing substantial operational and financial damage to individuals and businesses. This article explores the critical domain of Ransomware detection and employs Machine Learning (ML) classifiers, particularly Decision Tree (DT), for Ransomware detection. The article also delves into the usefulness of DT in identifying Ransomware attacks, leveraging the innate ability of DT to recognize complex patterns within datasets. Instead of merely introducing DT as a detection method, we adopt a comprehensive approach, emphasizing the importance of fine-tuning DT hyperparameters. The optimization of these parameters is essential for maximizing the DT capability to identify Ransomware threats accurately. The obfuscated-MalMem2022 dataset, which is well-known for its extensive and challenging Ransomware-related data, was utilized to evaluate the effectiveness of DT in detecting Ransomware. The implementation uses the versatile Python programming language, renowned for its efficiency and adaptability in data analysis and ML tasks. Notably, the DT classifier consistently outperforms other classifiers in Ransomware detection, including K-Nearest Neighbors, Gradient Boosting Tree, Naive Bayes, and Linear Support Vector Classifier. For instance, the DT demonstrated exceptional effectiveness in distinguishing between Ransomware and benign data, as evidenced by its remarkable accuracy of 99.97%.

Ransomware Detection Using Machine Learning: A Review, Research Limitations and Future Directions

Ransomware Detection Using Machine Learning: A Review, Research Limitations and Future Directions

Machine learning-based ransomware classification of Bitcoin transactions

Ransomware presents a significant threat to the security and integrity of cryptocurrency transactions. This research paper explores the intricacies of ransomware detection in cryptocurrency transactions using the Bitcoinheist dataset. The dataset encompasses 28 distinct families classified into three ransomware categories: Princeton, Montreal, and Padua, along with a white category representing legitimate transactions. We propose a novel hybrid supervised and semi-supervised multistage machine learning framework to tackle this challenge. Our framework effectively classifies known ransomware families by leveraging ensemble learning techniques such as Decision Tree, Random Forest, XGBoost, and Stacking. Additionally, we introduce a novel semi-supervised approach to accurately identify previously unseen ransomware instances within the dataset. Through rigorous evaluation employing comprehensive classification metrics, including accuracy, precision, recall, F1 score, RoC score, and prediction time, our proposed approach demonstrates promising results in ransomware detection within cryptocurrency transactions.

Integrating Ebola optimization search algorithm for enhanced deep learning-based ransomware detection in Internet of Things security

<abstract> <p>With the widespread use of Internet, Internet of Things (IoT) devices have exponentially increased. These devices become vulnerable to malware attacks with the enormous amount of data on IoT devices; as a result, malware detection becomes a major problem in IoT devices. A reliable and effective mechanism is essential for malware detection. In recent years, research workers have developed various techniques for the complex detection of malware, but accurate detection continues to be a problem. Ransomware attacks pose major security risks to corporate and personal information and data. The owners of computer-based resources can be influenced by monetary losses, reputational damage, and privacy and verification violations due to successful assaults of ransomware. Therefore, there is a need to swiftly and accurately detect the ransomware. With this motivation, the study designs an Ebola optimization search algorithm for enhanced deep learning-based ransomware detection (EBSAEDL-RD) technique in IoT security. The purpose of the EBSAEDL-RD method is to recognize and classify the ransomware to achieve security in the IoT platform. To accomplish this, the EBSAEDL-RD technique employs min-max normalization to scale the input data into a useful format. Also, the EBSAEDL-RD technique makes use of the EBSA technique to select an optimum set of features. Meanwhile, the classification of ransomware takes place using the bidirectional gated recurrent unit (BiGRU) model. Then, the sparrow search algorithm (SSA) can be applied for optimum hyperparameter selection of the BiGRU model. The wide-ranging experiments of the EBSAEDL-RD approach are performed on benchmark data. The obtained results highlighted that the EBSAEDL-RD algorithm reaches better performance over other models on IoT security.</p> </abstract>

Predicting Malware Classification and Family using Machine Learning: A Cuckoo Environment Approach with Automated Feature Selection

Malware’s increasing menace in the digital realm needs the development of powerful detection and classification systems. This study presents a unique method for predicting malware category and family using machine learning, leveraging the Cuckoo environment and automated feature selection. To undertake an exhaustive examination of malware activity, we combined the Cuckoo environment with cutting-edge machine learning methods, such as the k-Nearest Neighbors (KNN) technique. The dynamic analysis of malware samples within the Cuckoo environment, which captured their interactions with the execution environment, provided remarkable insights into their malicious behaviors. The Boruta method aided automated feature selection, improving the feature set and optimizing model performance. A comparison with existing models yielded striking findings. Notably, Test Case 3 surpassed earlier cases by incorporating Automated Feature Selection + Cross-Validation. In identifying phishing attempts, it displayed outstanding specificity (90%), precision (93%), recall (96%), and an impressive F1-Score (92%), indicating its proficiency in reliably recognizing this frequent threat. Test Case 3 showed considerable increases as well, with a surprising 7.0% increase in precision and a notable 14.6% increase in recall when compared to Test Case 1. Furthermore, in the field of ransomware detection, Test Case 4, which solely focused on Automated Feature Selection, obtained excellent results, with 91% specificity, 92% accuracy, and a recall rate of 93%. These developments highlight the importance of the Boruta algorithm in optimizing the model’s performance.

An Agent Based Model for Ransomware Detection and Mitigation in a Cloud System

An Agent Based Model for Ransomware Detection and Mitigation in a Cloud System

Ranker: Early Ransomware Detection Through Kernel-Level Behavioral Analysis

Ranker: Early Ransomware Detection Through Kernel-Level Behavioral Analysis