A Survey on Detection Techniques for Cryptographic Ransomware <s> I. INTRODUCTION <s> Abstract The focus of the paper is on providing insights on how ransomware have evolved from its starting till March 2016 by analyzing samples of selected ransomware variants from existing ransomware families in Windows and Android environments. Seventeen Windows and eight Android ransomware families were analyzed. For each ransomware family, at least, three variants belonging to the same family were compared. The analysis revealed that ransomware variants behave in a very similar manner, but use different payloads. Our analysis shows that there has been a significant improvement in encryption techniques used by ransomware. The experimental results in Windows environment demonstrate that detection of ransomware is possible by monitoring abnormal filesystem and registry activities. In Android environment, our analysis reveals that likelihood of ransomware attacks can be reduced by paying a closer attention to permissions requested by the Android applications. <s> BIB001 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> I. INTRODUCTION <s> Ransomware attacks have become a global incidence, with the primary aim of making monetary gains through illicit means. The attack started through e-mails and has expanded through spamming and phishing. Ransomware encrypts targets’ files and display notifications, requesting for payment before the data can be unlocked. Ransom demand is usually in form of virtual currency, bitcoin, because it is difficult to track. In this paper, we give a brief overview of the current trend, challenges, and research progress in the bid to finding lasting solutions to the menace of ransomware that currently challenge computer and network security, and data privacy. <s> BIB002 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> I. INTRODUCTION <s> The paper surveys state-of-the-art studies on ransomware analysis, detection, and prediction.The work describes the enabling technologies and factors that contribute to successful ransomware attacks.The paper proposes a general taxonomy for the different ransomware types from different perspectives.The study presents open issues and future research directions on ransomware analysis, detection and prediction. The proposed taxonomy classifies ransomware from three perspectives: severity based, platform based, and target based. Ransomware is a malware category that exploits security mechanisms such as cryptography in order to hijack user files and related resources and demands money in exchange for the locked data. Therefore, ransomware has become a lucrative business that has gained increasing popularity among attackers. Unlike traditional malware, even after removal, ransomware's effect is irreversible and difficult to mitigate without the help of its creator. In addition to the downtime costs and the money that individuals and business entities could pay as a ransom, those victims could incur other damage such as loss of data, reputation, and life. To date, several studies have been conducted to address this unique, challenging threat and have tried to provide detection and prevention solutions. However, there is a lack of survey articles that explore the research endeavors in ransomware and highlight the challenges and issues faced by existing solutions. This survey fills the gap and provides a holistic state-of-the-art review of the research on ransomware and its detection and prevention techniques. The survey puts forward a novel ransomware taxonomy, from several perspectives. It then elaborates on the factors that lead to a successful ransomware attacks before discussing in detail the research into counteracting ransomware, including analysis, prevention, detection and prediction solutions. The survey concludes with a brief discussion on the open issues and potential research directions in the near future. <s> BIB003 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> I. INTRODUCTION <s> In recent years, an increasing amount of locker-ransomware has been posing a great threat to the Android platform as well as users’ properties. Locker-ransomware blackmails victims for ransom by compulsorily locking the devices. What is worse, a mature locker-ransomware transaction chain has taken shape on Chinese social networks. The effective detection of locker-ransomware is an emergent yet crucial issue. To deal with this issue, in this paper, we are motivated to propose a light-weight and automated method for the detection of locker-ransomware. First, we conduct a thorough survey of the locker-ransomware’s transaction market and perform a comprehensive analysis of locker-ransomware’s behaviors. Second, to cope with the code obfuscation problem, we extract features of both displayed texts and background operations based on the observed behaviors. The fine-grained features are extracted from multiple sources, which can profile locker-ransomware in different aspects. Finally, we employ the ensemble of four machine learning algorithms for detection. The experimental results show that our method outperforms VirusTotal. It achieves the best performance with the detection accuracy of 99.98%. <s> BIB004
In 2018, ransomware dominated the reports on cybercrime, and became a malware threat targeting both businesses and users alike. Some reports describe ransomware not only as a tool of financially motivated criminals, but also for groups suspected of being aligned to the interests of some nations [1] . Ransomware has affected a broad spectrum of companies from manufacturing, transport, and telecommunications industries, financial companies, public law enforcement, and health services  ,  . Ransomware extorts users by locking access to computer resources and asking for a monetary payment to recover access. The first reports on ransomware that had a large impact referred to them as lockscreen ransomware. This type of malware locks access to a computer. In some cases, it impersonates law enforcement organisations, asking for the payment of a fine for some illegal activity performed by the user, such as downloading files or browsing child pornography websites. These strains are called police ransomware  . The associate editor coordinating the review of this manuscript and approving it for publication was Zahid Akhtar . Since 2015, police ransomware and lockscreen ransomware in general decayed in popularity and were substituted by a type of ransomware that encrypts user files and asks for a payment to provide the decryption key. This cryptographic ransomware is called crypto-ransomware or cryptoware. Ransomware payments can be carried using social networks BIB004 . However, most of them carry the payments using cryptocurrencies, and 98% of ransomware families use Bitcoin  . Although the reports on their economic impact are hardly accurate  , each year single strains of cryptoransomware reach new records of extended multi-national impact. WannaCry and NotPetya attacks in 2017 were estimated to have incurred global costs of more than $8 billion  . During only the first three weeks of 2018, GandCrab ransomware infected more than 50,000 systems. The incurred costs came not only from ransom payments but also from the cessation of business operations, the impact on the public image of affected companies, and insurance consequences. Not only desktop systems were affected, but also mobile ransomware increased its impact in 2017 [1] . Antivirus companies reported a three-fold increase in ransomware installation packages during the first quarter of 2017 compared to the previous quarter  ,  . Since 2018, malware developers VOLUME 7, 2019 This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see http://creativecommons.org/licenses/by/4.0/ began to use droppers -trojan software that looks like a benign program, but once executed, downloads or extracts the real malware and installs it in a computer  . The detection and blockage of crypto-ransomware has been a very active area of research in recent years, because of the massive expansion of this form of malware. Proposals and developments have come from both the industrial sectors and academia. Most detection solutions run local to a user host, working like an antivirus software to detect and block ransomware activity. However, proposals exist that are based on detecting ransomware network activity or blocking network traffic to servers needed by the malware. These detection algorithms are based on a diversity of ad-hoc heuristics and artificial intelligence techniques. The simplest solutions are customised for detecting a single ransomware type; however, more general proposals are capable of the detection of zero-day attacks. Our survey covers the case of cryptoransomware, and from this point forward, any reference to ransomware refers to a ransomware that encrypts user files. No previous complete surveys on ransomware detection techniques exist because of the novelty of this type of malware and the fast-paced changing scenario of malware. Most surveys limited their scope to a description of the behaviour of different ransomware families BIB001 -  or the ransomware families were included as a category in a broader study of malware  . The description of detection techniques is usually short and only in the form of suggestions and ideas  , BIB002 and not formal algorithms. The most complete surveys on the topic are those of Eze et al.  and in particular of Al-rimy et al. BIB003 . Although Eze et al.  cites several research papers on ransomware detection in a simple classification, it does not provide a complete review of the literature, but only a two-page introduction to the topic. Al-rimy et al. BIB003 presents an extensive classification on ransomware behaviour and an up-to-date classification of detection algorithms in the research literature. However, he does not provide a description of the input parameters and classification results provided by these proposals. Further, he covers the broad topic of ransomware without providing sufficient detail on the detection algorithms, which is the sole topic of our review. In this survey, we reviewed 50 proposals for the detection of cryptoware activity. Most came from academia, but we also added the description of existing commercial products based on the available public information. We present a classification based on the behavioural characteristics extracted from a running system and the mathematical tools used in their analysis: machine learning (ML)-based and threshold based. The techniques for ransomware detection are based on distinguishing ransomware action from benign software. In this study, we classified ransomware action as different detection techniques. This is a different classification from those presented in the literature. An in-depth analysis of ransomware characteristics is vital to create an accurate detection algorithm. We describe the characteristics of 48 different ransomware families from the analysis of 64 collected samples. We extracted these characteristics from running the actual samples. The survey papers in the literature describing ransomware action had no access to such a large database and did not offer first-hand analysis. We classify these families and relate them to the proposed detection techniques. There are no common metrics of accuracy and performance in ransomware detection. Some studies with a new detection algorithm compared their proposals with previous ones, but not all of them, and only to the extent of the ransomware families they targeted. We describe and compare the results of all these proposals, and we complete this paper with a description of unsolved issues. The remainder of this paper is structured as follows: Section II details the characteristics of the different ransomware families from the point of view of the design of detection algorithms. Section III offers a classification and description of the input data that the detection algorithms extracted from ransomware. Section IV groups the detection algorithms based on the logic of how to use the input data to obtain a classification decision. We also describe the main aspects of these algorithms. Section VI presents the detection and performance results offered in the literature. Section VII discusses open issues in crypto-ransomware detection. Section VIII concludes the paper.