Ransomware Behavior Research Articles

Ransomware Mitigation for Secure and Smart Cloud Manufacturing Using GeniLeaf Decision Tree with Load Balancing

Background: Cyber-attacks related to ransomware have increased significantly in cloud manufacturing industries over the last decade, causing considerable disruptions to organizations. This type of information may also include personal details, patent rights, bank account details, etc. This type of malware requires new and better mitigation methods. Objective: The primary objective of this study was to provide an algorithm to execute experiments using genetic algorithms for load balancing with decision trees and mitigate ransomware. Methods: Hybrid analysis and machine learning techniques were used in this study to identify ransomware. Since a wide range of samples impacted by ransomware share most of the characteristics, it may be possible to use this study to detect current and future malware variants in industries. Results: In patented industrial technology, ransomware mitigation plays a crucial role based on the analysis of various papers and patents-to-science references. In this study, a machine learning mitigation algorithm, GeniLeaf Decision Tree (GLDT), was applied to a featured dataset using a genetic algorithm with a decision tree Conclusion: Machine learning and load balancing are used to gain insight into ransomware behavior. By using the proposed approach to mitigate ransomware and spoofing patterns, a high level of accuracy is achieved. Using GeniLeaf Decision Trees to mitigate ransomware is a significant innovation.

Enhancing Cybersecurity: Ransomware Detection - A Proof of Concept Study

Presently, our digital landscape faces a pervasive onslaught of diverse cyber threats, encompassing distributed denial of service (DDoS), phishing, ransomware, and smishing, all orchestrated with malicious intent. Counteracting these malicious incursions poses a formidable challenge, particularly in devising efficacious detection solutions. Ransomware incidents are on the ascent, particularly within critical sectors such as healthcare, finance, and telecommunications. Consequently, this paper introduces a proof of concept (POC) aimed at detecting ransomware activities targeting Internet of Medical Things (IoMT) devices. The primary objective of this paper revolves around the identification and evaluation of factors correlating with ransomware attacks on IoMT and then developing a ransomware detector. The experimental framework involves the utilization of a simulated environment mirroring real-world IoMT devices and networks. The methodology integrates diverse approaches, encompassing data collection from IoMT devices, analysis of ransomware behaviour through the study of encryption patterns, and anomaly detection. The POC assesses the efficacy of these methodologies in detecting and responding to ransomware threats, with the experimentation conducted through hybrid analysis within a controlled laboratory setting. The dataset consists of 13 families with a total malware of 9251 taken from GitHub. For POC, a total of 3459 ransomware dataset samples have been selected. As a result of the experiment, thirteen (13) distinct features have been identified as trigger factors for ransomware attacks. These features are obtained by capturing of the processes initiated by the ransomware samples using a process monitor (procmon). A temporal pattern of the processes which include the file system, API, and access based on their frequency of occurrence were used to develop a ransomware detection model. The proposed approach achieved an accuracy of 99.2% and an error rate of 0.8 %, when evaluated on temporal pattern dataset and by using an enhanced artificial neural network (EANN).

Clop Ransomware in Action: A Comprehensive Analysis of Its Multi-Stage Tactics

Recently, Clop ransomware attacks targeting non-IT fields such as distribution, logistics, and manufacturing have been rapidly increasing. These advanced attacks are particularly concentrated on Active Directory (AD) servers, causing significant operational and financial disruption to the affected organizations. In this study, the multi-step behavior of Clop ransomware was deeply investigated to decipher the sequential techniques and strategies of attackers. One of the key insights uncovered is the vulnerability in AD administrator accounts, which are often used as a primary point of exploitation. This study aims to provide a comprehensive analysis that enables organizations to develop a deeper understanding of the multifaceted threats posed by Clop ransomware and to build more strategic and robust defenses against them.

Novel Ransomware Detection Exploiting Uncertainty and Calibration Quality Measures Using Deep Learning

Ransomware poses a significant threat by encrypting files or systems demanding a ransom be paid. Early detection is essential to mitigate its impact. This paper presents an Uncertainty-Aware Dynamic Early Stopping (UA-DES) technique for optimizing Deep Belief Networks (DBNs) in ransomware detection. UA-DES leverages Bayesian methods, dropout techniques, and an active learning framework to dynamically adjust the number of epochs during the training of the detection model, preventing overfitting while enhancing model accuracy and reliability. Our solution takes a set of Application Programming Interfaces (APIs), representing ransomware behavior as input we call “UA-DES-DBN”. The method incorporates uncertainty and calibration quality measures, optimizing the training process for better more accurate ransomware detection. Experiments demonstrate the effectiveness of UA-DES-DBN compared to more conventional models. The proposed model improved accuracy from 94% to 98% across various input sizes, surpassing other models. UA-DES-DBN also decreased the false positive rate from 0.18 to 0.10, making it more useful in real-world cybersecurity applications.

An Incremental Mutual Information-Selection Technique for Early Ransomware Detection

Ransomware attacks have emerged as a significant threat to critical data and systems, extending beyond traditional computers to mobile and IoT/Cyber–Physical Systems. This study addresses the need to detect early ransomware behavior when only limited data are available. A major step for training such a detection model is choosing a set of relevant and non-redundant features, which is challenging when data are scarce. Therefore, this paper proposes an incremental mutual information-selection technique as a method for selecting the relevant features at the early stages of ransomware attacks. It introduces an adaptive feature-selection technique that processes data in smaller, manageable batches. This approach lessens the computational load and enhances the system’s ability to quickly adapt to new data arrival, making it particularly suitable for ongoing attacks during the initial phases of the attack. The experimental results emphasize the importance of the proposed technique in estimating feature significance in limited data scenarios. Such results underscore the significance of the incremental approach as a proactive measure in addressing the escalating challenges posed by ransomware.

An Approach to Android Ransomware Detection Using Deep Learning

As mobile devices continue to grow in popularity, the threat of ransomware attacks on Android devices has escalated, leading to serious privacy and financial risks for users. Traditional methods of ransomware detection have become less effective due to the evolving nature of these attacks. Consequently, the application of deep learning techniques offers promising potential for the detection and prevention of Android ransomware. This paper proposes an approach that utilizes deep learning algorithms to analyze and identify ransomware behavior on Android devices, aiming to enhance the security measures against these malicious threats. The model we used is a feedforward neural network model using the Keras Sequential. The model consists of three layers of densely connected neurons. The first layer has 64 units, the second layer also has 64 units, and the third and final layer has 2 units. The proposed model gave accuracy 98.9%.

Early Detection of Windows Cryptographic Ransomware Based on Pre-Attack API Calls Features and Machine Learning

Ransomware attacks are currently one of cybersecurity's greatest and most alluring threats. Antivirus software is frequently ineffective against zero-day malware and ransomware attacks; consequently, significant network infections could result in substantial data loss. Such attacks are also becoming more dynamic and capable of altering their signatures, resulting in a race to the bottom regarding weaponry. Cryptographic ransomware exploits crypto-viral extortion techniques. The malware encrypts the victim's data and demands payment in exchange. The attacker would release the data decryption key after accepting payment. After data encryption, the user has two options: pay the ransom or lose the data. Cryptographic ransomware causes damage that is nearly impossible to undo. Detection at an early stage of a ransomware attack's lifecycle is vital for preventing unintended consequences for the victim. Most ransomware detection technologies concentrate on detection during encryption and post-attack stages. Due to the absence of early behaviour signs, it is challenging to detect ransomware before it begins the unwanted process of mass file encryption. This study examines the relationship between API calls pattern and their nature to determine whether it is ransomware early behaviour. The purpose of this paper is to determine whether this technique can be used to early detect the presence of ransomware activity on a Windows endpoint. 582 ransomware samples that consist of ten ransomware families and 942 benign software samples were analysed. This study proposed RENTAKA, a novel framework for the early detection of cryptographic ransomware. It makes use of characteristics acquired from ransomware behaviour and machine learning. This study presented an algorithm to generate a ransomware pre-encryption dataset. This study, which includes six machine-learning models, gives satisfactory results in detecting cryptographic ransomware. The features used in this research were among the 232 features identified in Windows API calls. Five standard machine learning classifiers were employed in this experiment: Naive Bayes, k-nearest neighbours (kNN), Support Vector Machines (SVM), Random Forest, and J48. In our tests, SVM fared the best, with an accuracy rate of 93.8% and an area under the curve (AUC) of 0.979, respectively. The results indicate that we can distinguish ransomware from benign applications with low false-positive and false-negative rates.

FeSAD ransomware detection framework with machine learning using adaption to concept drift

This paper proposes FeSAD, a framework that will allow a machine learning classifier to detect evolutionary ransomware. Ransomware is a critical player in the malware space that causes hundreds of millions of dollars of damage globally and evolves quickly. The evolution of ransomware in machine learning classifiers is often calculated as concept drift. Concept drift is dangerous as changes in the behavior of ransomware can easily lead to misclassifications, and misclassification can harm individuals and businesses. Our proposed framework consists of a feature selection layer, drift calibration layer and drift decision layer that allows a machine learning classifier to detect and classify concept drift samples reliably. We evaluate the FeSAD framework in various concept drift scenarios and observe its ability to detect drifting samples effectively. The FeSAD framework is also evaluated on its ability to extend the lifespan of a classifier. The results obtained by this research show that FeSAD can successfully and reliably classify ransomware and benign samples while under concept drift and can extend the time between retraining.

Ransomware Behavior on Windows Endpoint: An Analysis

This paper provides a comprehensive examination of ransomware behavior on Windows endpoints, exploring the intrusion mechanisms, proliferation methods, and the mitigating strategies that can be employed. It provides a comparative analysis of several ransomware families and their effects on Windows systems, culminating with suggestions for future research directions in enhancing endpoint security against ransomware attacks. In the wake of a rising number of ransomware attacks worldwide, epitomized by the damaging disruptions to the Colonial Pipeline and the Irish Health Service Executive, the persistent threat of ransomware to critical infrastructure has never been more apparent. While Windows endpoints remain primary targets, these attacks have also highlighted a less explored but crucial aspect of ransomware behavior: the exploitation of Application Programming Interface (API) calls integral to the Windows operating system. This comprehensive study provides an exhaustive investigation into the interplay between ransomware and Windows APIs, emphasizing the patterns of invocation and manipulative misuse by various ransomware families. By investigating specific API calls, such as the CryptEncrypt function in the Cryptography API for encryption, and the CreateFile and WriteFile functions in the File API for file system interaction, we illuminate the mechanisms by which ransomware carry out their damaging actions. Further, using the real-world examples drawn from the Colonial Pipeline and Irish Health Service Executive incidents, among others, the study shows how these API calls were manipulated during actual ransomware attacks. In these cases, ransomware like DarkSide and Conti used Windows APIs not just for the primary tasks of encryption and file system manipulation, but also for achieving network communication, maintaining persistence, and even thwarting detection. By presenting a comparative analysis of API call sequences in both benign and ransomware-infected Windows environments, this study serves as a critical exploration into the behavior of these malicious entities. The different patterns observed provide us with valuable insights into their operational strategies and offer opportunities for the development of detection heuristics. The insights derived from this research contribute significantly to our understanding of the behavior patterns of recent, high-profile ransomware attacks. In turn, this work aims to guide the evolution of more sophisticated, behavior-based detection mechanisms, thus strengthening the security posture of Windows endpoints. Ultimately, this study underscores the need for continuous research into API call patterns, as the cybersecurity landscape continues to face dynamic and increasingly sophisticated threats.

Investigating IPTV Malware in the Wild

Technologies providing copyright-infringing IPTV content are commonly used as an illegal alternative to legal IPTV subscriptions and services, as they usually have lower monetary costs and can be more convenient for users who follow content from different sources. These infringing IPTV technologies may include websites, software, software add-ons, and physical set-top boxes. Due to the free or low cost of illegal IPTV technologies, illicit IPTV content providers will often resort to intrusive advertising, scams, and the distribution of malware to increase their revenue. We developed an automated solution for collecting and analysing malware from illegal IPTV technologies and used it to analyse a sample of illicit IPTV websites, application (app) stores, and software. Our results show that our IPTV Technologies Malware Analysis Framework (IITMAF) classified 32 of the 60 sample URLs tested as malicious compared to running the same test using publicly available online antivirus solutions, which only detected 23 of the 60 sample URLs as malicious. Moreover, the IITMAF also detected malicious URLs and files from 31 of the sample’s websites, one of which had reported ransomware behaviour.

An Enhanced Minimax Loss Function Technique in Generative Adversarial Network for Ransomware Behavior Prediction

Recent ransomware attacks threaten not only personal files but also critical infrastructure like smart grids, necessitating early detection before encryption occurs. Current methods, reliant on pre-encryption data, suffer from insufficient and rapidly outdated attack patterns, despite efforts to focus on select features. Such an approach assumes that the same features remain unchanged. This approach proves ineffective due to the polymorphic and metamorphic characteristics of ransomware, which generate unique attack patterns for each new target, particularly in the pre-encryption phase where evasiveness is prioritized. As a result, the selected features quickly become obsolete. Therefore, this study proposes an enhanced Bi-Gradual Minimax (BGM) loss function for the Generative Adversarial Network (GAN) Algorithm that compensates for the attack patterns insufficiency to represents the polymorphic behavior at the earlier phases of the ransomware lifecycle. Unlike existing GAN-based models, the BGM-GAN gradually minimizes the maximum loss of the generator and discriminator in the network. This allows the generator to create artificial patterns that resemble the pre-encryption data distribution. The generator is used to craft evasive adversarial patterns and add them to the original data. Then, the generator and discriminator compete to optimize their weights during the training phase such that the generator produces realistic attack patterns, while the discriminator endeavors to distinguish between the real and crafted patterns. The experimental results show that the proposed BGM-GAN reached maximum accuracy of 0.98, recall (0.96), and a minimum false positive rate (0.14) which all outperform those obtained by the existing works. The application of BGM-GAN can be extended to early detect malware and other types of attacks.

Early prediction of ransomware API calls behaviour based on GRU-TCN in healthcare IoT

The healthcare industry is collecting considerable patient and medical data by using Internet of Things (IoT) devices. Consequently, ransomware attacks to encrypt healthcare systems or leak such data have increased recently. Many studies are aiming to predict ransomware behaviours early to protect the healthcare IoT environment from such attacks. However, previous studies analysed ransomware behaviours for long periods of time, and systems would already get infected and encrypted meanwhile. To avoid this problem, this study proposes an early prediction scheme of ransomware behaviour (EPS-Ran) to reduce the likelihood of systems being infected during behavioural analysis. EPS-Ran analyses behaviours for 30 s to extract the opcode and API calls sequence. The extracted behaviour features are entered into a hybrid deep learning model that combines the bidirectional gated recurrent unit (Bi-GRU) model and the temporal convolutional network (TCN) model to predict a future 90 s API calls sequence. The MAE, MSE, and RMSE of the prediction performance of EPS-Ran were measured to be 0.3438, 0.5648, and 0.6342, respectively. EPS-Ran predicted ransomware behaviours early with a low error rate even when the analysis time was reduced from 120 s to 30 s.

CONSEQUENCES OF PAYING A RANSOM WHILE RANSOMWARE ATTACK

The subject of this article is devoted to the actions taken by personnel of organizations that havebecome the target of a ransomware attack. It should be noted here that within the framework ofthe considerations undertaken, reference was made not to technical - IT undertakings aimed atunlocking the attacked system, but to the harmfulness of ransomware behavior, both in the area ofactivities of public entities and in the business environment. The methodology for thedevelopment of the article was based on the analysis of information on the phenomenon ofransomware, as well as on the ranking and analysis of the legislation governing the issue ofliability in the event of ransomware placement. The research problem of the manuscript wascontained in the question: what are the consequences for those who decide to transferransomware, as well as those who seek a way to finance the ransomware attack? At the same time,it was assumed that this is the responsibility of both those who decide to pay the ransom and thepersonnel who supervise the activities of the entities. It was also attempted to depict that theresponsibility for the ransomware decision arises both in the area of public entities and withingthe scope of companies prospering in the private economic sector.

A brief overview of ransomware behavior analysis challenges / Uma breve visão geral dos desafios da análise do comportamento do resgate de bens

The ransomware threat is a widespread and growing menace that has caused havoc on many companies and institutions over the world. By leveraging vulnerable and insecure software and using social engineering, cybercriminals have found a wide opportunity for considerable profit in the thriving age of digital businesses and cyber currency payments. In this light, malware behavior analysis plays a crucial role in the development of proper prevention and detection technology and is the cornerstone of an effective incident response practice. Given this, this survey attempts to perform an overview of the aspects of ransomware behavior that, depending on the prominence of its end goals, can facilitate or hinder its analysis.

Mitigating adversarial evasion attacks of ransomware using ensemble learning

Ransomware continues to pose a significant threat to cybersecurity by extorting money from users by locking their devices and personal data. The attackers force the payment of a ransom in order to restore access to personal files. Because of the structural similarity, detection of ransomware and benign applications becomes vulnerable to evasion attacks. Ensemble learning can provide countermeasures, while attackers can use the same technique to improve the effectiveness of their respective attacks. This motivates us to investigate whether the distinct ensemble method can achieve better performance when combined with the voting-based method. This research proposes a hybrid approach that examines permissions, text, and network-based features both statically and dynamically by monitoring memory usage, system call logs, and CPU usage. Ensemble machine learning analyzers on static and dynamic features extracted from Android malware applications (ransomware and non-ransomware) are then trained in the designed model. Our experimental results show that the proposed ensemble classification and detection technique can classify unknown static and dynamic ransomware behavior to mitigate adversarial evasion attacks.

Evading behavioral classifiers: a comprehensive analysis on evading ransomware detection techniques

Recent progress in machine learning has led to promising results in behavioral malware detection. Behavioral modeling identifies malicious processes via features derived by their runtime behavior. Behavioral features hold great promise as they are intrinsically related to the functioning of each malware, and are therefore considered difficult to evade. Indeed, while a significant amount of results exists on evasion of static malware features, evasion of dynamic features has seen limited work. This paper examines the robustness of behavioral ransomware detectors to evasion and proposes multiple novel techniques to evade them. Ransomware behavior differs significantly from that of benign processes, making it an ideal best case for behavioral detectors, and a difficult candidate for evasion. We identify and propose a set of novel attacks that distribute the overall malware workload across a small set of independent, cooperating processes in order to avoid the generation of significant behavioral features. Our most effective attack decreases the accuracy of a state-of-the-art classifier from 98.6 to 0% using only 18 cooperating processes. Furthermore, we show our attacks to be effective against commercial ransomware detectors in a black-box setting. Finally, we evaluate a detector designed to identify our most effective attack, as well as discuss potential directions to mitigate our most advanced attack.

Ransomware Detection using Process Memory

Ransomware attacks have increased significantly in recent years, causing great destruction and damage to critical systems and business operations. Attackers are unfailingly finding innovative ways to bypass detection mechanisms, which encouraged the adoption of artificial intelligence. However, most research summarizes the general features of AI and induces many false positives, as the behavior of ransomware constantly differs to bypass detection. Focusing on the key indicating features of ransomware becomes vital as this guides the investigator to the inner workings and main function of ransomware itself. By utilizing access privileges in process memory, the main function of the ransomware can be detected more easily and accurately. Furthermore, new signatures and fingerprints of ransomware families can be identified to classify novel ransomware attacks correctly. The current research used the process memory access privileges of the different memory regions of the behavior of an executable to quickly determine its intent before serious harm can occur. To achieve this aim, several well-known machine learning algorithms were explored with an accuracy range of 81.38% – 96.28%. The study thus confirms the feasibility of utilizing process memory as a detection mechanism for ransomware.

Signature-less ransomware detection and mitigation

Ransomware is a challenging threat that encrypts a user's files until some ransom is paid by the victim. This type of malware is a profitable business for attackers, generating millions of dollars annually. Several approaches based on signature matching have been proposed to detect ransomware intrusions but they fail to detect ransomware whose signature is unknown. We try to detect ransomware's behaviour with the help of a mini-filter driver using a signature-less detection method. The proposed technique combines the working of Shannon’s entropy and fuzzy hash to provide better results in detecting ransomware. Not only this technique has been practically tested but has been successful in detecting over 95% of the tested ransomware attacks on windows operating systems.

A Study on the Evolution of Ransomware Detection Using Machine Learning and Deep Learning Techniques

This survey investigates the contributions of research into the detection of ransomware malware using machine learning and deep learning algorithms. The main motivations for this study are the destructive nature of ransomware, the difficulty of reversing a ransomware infection, and how important it is to detect it before infecting a system. Machine learning is coming to the forefront of combatting ransomware, so we attempted to identify weaknesses in machine learning approaches and how they can be strengthened. The threat posed by ransomware is exceptionally high, with new variants and families continually being found on the internet and dark web. Recovering from ransomware infections is difficult, given the nature of the encryption schemes used by them. The increase in the use of artificial intelligence also coincides with this boom in ransomware. The exploration into machine learning and deep learning approaches when it comes to detecting ransomware poses high interest because machine learning and deep learning can detect zero-day threats. These techniques can generate predictive models that can learn the behaviour of ransomware and use this knowledge to detect variants and families which have not yet been seen. In this survey, we review prominent research studies which all showcase a machine learning or deep learning approach when detecting ransomware malware. These studies were chosen based on the number of citations they had by other research. We carried out experiments to investigate how the discussed research studies are impacted by malware evolution. We also explored the new directions of ransomware and how we expect it to evolve in the coming years, such as expansion into IoT (Internet of Things), with IoT being integrated more into infrastructures and into homes.

A system call refinement-based enhanced Minimum Redundancy Maximum Relevance method for ransomware early detection

Ransomware is a special type of malicious software that encrypts the user's assets and makes it unavailable to the users until a ransom is paid to the ransomware author. Such attacks have become one of the most widespread malware that poses serious threat to both individuals and business organizations. Against this destructive malicious program, the dynamic analysis approach is the most popular approach for detecting such an attack. The majority of dynamic analysis relies on the system calls, as these provide an interface for programs to request service from the operating system. However, the redundancy and the irrelevant system calls that the ransomware authors inject in the actual execution flow of suspicious binaries generate a high noisy behavioural sequence that adversely impacts in the detection performance of anti-ransomware tools. To this end, we proposed a non-signature-based detection approach based on the effective windows API call sequences using supervised machine learning techniques. To achieve this objective, we propose an Enhanced Maximum-Relevance and Minimum-Redundancy (EmRmR) filter method to remove the noisy features and select the most relevant subset of features to characterize the real behaviour of the ransomware. Unlike the original mRmR, the EmRmR avoids unnecessary computations intrinsic in the original mRmR algorithms with a small number of evaluations. In addition, this work has introduced a refinement process to reduce the size of the program's call traces by removing those windows API calls that do not have a strong indication for describing the critical behaviour of the ransomware. After accomplishing extensive experimental evaluations, and comparing with existing behavioural-based detection approaches, the proposed method has shown to be effective for discriminating the behaviour of ransomware, and indicates a high detection accuracy with few false-positive rates.