Abstract Ransomware constitutes a significant threat to the Android operating system. It can either lock or encrypt the target devices, and victims are forced to pay ransoms to restore their data. Hence, the prompt detection of such attacks has a priority in comparison to other malicious threats. Previous works on Android malware detection mainly focused on Machine Learning-oriented approaches that were tailored to identifying malware families, without a clear focus on ransomware. More specifically, such approaches resorted to complex information types such as permissions, user-implemented API calls, and native calls. However, this led to significant drawbacks concerning complexity, resilience against obfuscation, and explainability. To overcome these issues, in this paper, we propose and discuss learning-based detection strategies that rely on System API information. These techniques leverage the fact that ransomware attacks heavily resort to System API to perform their actions, and allow distinguishing between generic malware, ransomware and goodware. We tested three different ways of employing System API information, i.e., through packages, classes, and methods, and we compared their performances to other, more complex state-of-the-art approaches. The attained results showed that systems based on System API could detect ransomware and generic malware with very good accuracy, comparable to systems that employed more complex information. Moreover, the proposed systems could accurately detect novel samples in the wild and showed resilience against static obfuscation attempts. Finally, to guarantee early on-device detection, we developed and released on the Android platform a complete ransomware and malware detector (R-PackDroid) that employed one of the methodologies proposed in this paper.
proposed a tool to monitor the activity of ransomware by dumping the system messages log, including stack traces. Sadly, no implementation has been released for public usage @cite_13 .
@cite_13
2177710037
Along with the rapid growth of new science andtechnology, the functions of smartphones become more and morepowerful. Nevertheless, everything has two aspects. Smartphonesbring so much convenience for people and also bring the securityrisks at the same time. Malicious application has become a bigthreat to the mobile security. Thus, an efficiency security analysisand detection method is important and necessary. Due toattacking of malicious application, user could not use smartphonenormally and personal information could be stolen. What isworse, attacking proliferation will impact the healthy growth ofthe mobile Internet industry. To limit the growing speed ofmalicious application, the first thing we need to know whatmalicious application is and how to deal with. Detecting andanalyzing their behaviors helps us deeply understand theattacking principle such that we can take effectivecountermeasures against malicious application. This articledescribes the basic Android component and manifest, the reasonthat Android is prevalent and why attacking came in. This paperanalyzed and penetrated malicious ransomware which threatsmobile security now with our developed automated analysisapproach for such mobile malware detection.