A Survey on Detection Techniques for Cryptographic Ransomware <s> B. MACHINE LEARNING-BASED PROPOSALS <s> This paper investigates the application of the mutual information criterion to evaluate a set of candidate features and to select an informative subset to be used as input data for a neural network classifier. Because the mutual information measures arbitrary dependencies between random variables, it is suitable for assessing the "information content" of features in complex classification tasks, where methods bases on linear relations (like the correlation) are prone to mistakes. The fact that the mutual information is independent of the coordinates chosen permits a robust estimation. Nonetheless, the use of the mutual information for tasks characterized by high input dimensionality requires suitable approximations because of the prohibitive demands on computation and samples. An algorithm is proposed that is based on a "greedy" selection of the features and that takes both the mutual information with respect to the output class and with respect to the already-selected features into account. Finally the results of a series of experiments are discussed. > <s> BIB001 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. MACHINE LEARNING-BASED PROPOSALS <s> Preventive and reactive security measures can only partially mitigate the damage caused by modern ransomware attacks. Indeed, the remarkable amount of illicit profit and the cyber-criminals' increasing interest in ransomware schemes suggest that a fair number of users are actually paying the ransoms. Unfortunately, pure-detection approaches (e.g., based on analysis sandboxes or pipelines) are not sufficient nowadays, because often we do not have the luxury of being able to isolate a sample to analyze, and when this happens it is already too late for several users! We believe that a forward-looking solution is to equip modern operating systems with practical self-healing capabilities against this serious threat. Towards such a vision, we propose ShieldFS, an add-on driver that makes the Windows native filesystem immune to ransomware attacks. For each running process, ShieldFS dynamically toggles a protection layer that acts as a copy-on-write mechanism, according to the outcome of its detection component. Internally, ShieldFS monitors the low-level filesystem activity to update a set of adaptive models that profile the system activity over time. Whenever one or more processes violate these models, their operations are deemed malicious and the side effects on the filesystem are transparently rolled back. We designed ShieldFS after an analysis of billions of low-level, I/O filesystem requests generated by thousands of benign applications, which we collected from clean machines in use by real users for about one month. This is the first measurement on the filesystem activity of a large set of benign applications in real working conditions. We evaluated ShieldFS in real-world working conditions on real, personal machines, against samples from state of the art ransomware families. ShieldFS was able to detect the malicious activity at runtime and transparently recover all the original files. Although the models can be tuned to fit various filesystem usage profiles, our results show that our initial tuning yields high accuracy even on unseen samples and variants. <s> BIB002 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. MACHINE LEARNING-BASED PROPOSALS <s> Recent statistics show that in 2015 more than 140 millions new malware samples have been found. Among these, a large portion is due to ransomware, the class of malware whose specific goal is to render the victim's system unusable, in particular by encrypting important files, and then ask the user to pay a ransom to revert the damage. Several ransomware include sophisticated packing techniques, and are hence difficult to statically analyse. We present EldeRan, a machine learning approach for dynamically analysing and classifying ransomware. EldeRan monitors a set of actions performed by applications in their first phases of installation checking for characteristics signs of ransomware. Our tests over a dataset of 582 ransomware belonging to 11 families, and with 942 goodware applications, show that EldeRan achieves an area under the ROC curve of 0.995. Furthermore, EldeRan works without requiring that an entire ransomware family is available beforehand. These results suggest that dynamic analysis can support ransomware detection, since ransomware samples exhibit a set of characteristic features at run-time that are common across families, and that helps the early detection of new variants. We also outline some limitations of dynamic analysis for ransomware and propose possible solutions. <s> BIB003 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. MACHINE LEARNING-BASED PROPOSALS <s> Ransomwares have become a growing threat since 2012, and the situation continues to worsen until now. The lack of security mechanisms and security awareness are pushing the systems into mire of ransomware attacks. In this paper, a new framework called 2entFOX' is proposed in order to detect high survivable ransomwares (HSR). To our knowledge this framework can be considered as one of the first frameworks in ransomware detection because of little publicly-available research in this field. We analyzed Windows ransomwares' behaviour and we tried to find appropriate features which are particular useful in detecting this type of malwares with high detection accuracy and low false positive rate. After hard experimental analysis we extracted 20 effective features which due to two highly efficient ones we could achieve an appropriate set for HSRs detection. After proposing architecture based on Bayesian belief network, the final evaluation is done on some known ransomware samples and unknown ones based on six different scenarios. The result of this evaluations shows the high accuracy of 2entFox in detection of HSRs. <s> BIB004 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. MACHINE LEARNING-BASED PROPOSALS <s> Ransomware is one of the most increasing malwares used by cyber-criminals in recent days. This type of malware uses cryptographic technology that encrypts a user's important files, folders makes the computer systems unusable, holds the decryption key and asks for the ransom from the victims for recovery. The recent ransomware families are very sophisticated and difficult to analyze & detect using static features only. On the other hand, latest crypto-ransomwares having sandboxing and IDS evading capabilities. So obviously, static or dynamic analysis of the ransomware alone cannot provide better solution. In this paper, we will present a Machine Learning based approach which will use integrated method, a combination of static and dynamic analysis to detect ransomware. The experimental test samples were taken from almost all ransomware families including the most recent “WannaCry”. The results also suggest that combined analysis can detect ransomware with better accuracy compared to individual analysis approach. Since ransomware samples show some “run-time” and “static code” features, it also helps for the early detection of new and similar ransomware variants. <s> BIB005 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. MACHINE LEARNING-BASED PROPOSALS <s> In recent cyber incidents, Ransom software (ransomware) causes a major threat to the security of computer systems. Consequently, ransomware detection has become a hot topic in computer security. Unfortunately, current signature-based and static detection model is often easily evadable by obfuscation, polymorphism, compress, and encryption. For overcoming the lack of signature-based and static ransomware detection approach, we have proposed the dynamic ransomware detection system using data mining techniques such as Random Forest (RF), Support Vector Machine (SVM), Simple Logistic (SL) and Naive Bayes (NB) algorithms for detecting known and unknown ransomware. We monitor the actual (dynamic) behaviors of software to generate API calls flow graphs (CFG) and transfer it in a feature space. Thereafter, data normalization and feature selection were applied to select informative features which are the best for discriminating between various categories of software and benign software. Finally, the data mining algorithms were used for building the detection model for judging whether the software is benign software or ransomware. Our experimental results show that our proposed system can be more effective to improve the performance for ransomware detection. Especially, the accuracy and detection rate of our proposed system with Simple Logistic (SL) algorithm can achieve to 98.2% and 97.6%, respectively. Meanwhile, the false positive rate also can be reduced to 1.2%. <s> BIB006 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. MACHINE LEARNING-BASED PROPOSALS <s> As a new type of malicious software, ransomware is one of the biggest security threats in recent years. Inspired by biological immune system, a ransomware detection method based on V-detector negative selection algorithm with mutation optimization is proposed, which is referred to op-RDVD. The behavioral features of ransomware are extracted through dynamic analysis, such as hard disk reading and writing, the document encryption and deletion, etc. Some of benign samples are used to build the self space. The variable-sized detectors are generated both randomly and extracted from ransomware. To improve the ransomware detection accuracy and efficiency, optimize the space distribution of detectors through clone and mutation, achieving maximized coverage of non-self space and minimized overlapping among detectors. The experimental results show that our algorithm has better detection ability than that of the previous method. <s> BIB007 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. MACHINE LEARNING-BASED PROPOSALS <s> Ransomware is one type of malware that covertly installs and executes a cryptovirology attack on a victims computer to demand a ransom payment for restoration of the infected resources. This kind of malware has been growing largely in recent days and causes tens of millions of dollars losses to consumers. In this paper, we evaluate shallow and deep networks for the detection and classification of ransomware. To characterize and distinguish ransomware over benign and various other families of ransomwares, we leverage the dominance of application programming interface (API) invocations. To select a best architecture for the multi-layer perceptron (MLP), we done various experiments related to network parameters and structures. All the experiments are run up to 500 epochs with a learning rate in the range [0.01-0.5]. Result obtained on our data set is more promising to distinguish ransomware not only from benign from its families too. On distinguishing the .EXE as either benign or ransomware, MLP has attained highest accuracy 1.0 and classifying the ransomware to their categories obtained highest accuracy 0.98. Moreover, MLP has performed well in detecting and classifying ransomwares in comparison to the other classical machine learning classifiers. <s> BIB008 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. MACHINE LEARNING-BASED PROPOSALS <s> Ransomware is a malware that stealthily gets installed in your device and holds your files or operating system functions for ransom. It restricts you from using your PC or mobile device, by encrypting your files. Paying ransom (through Bitcoins) however, does not guarantee that you'll get your files back. Prevention is still way better than allowing yourself to be infected and then trying to find a cure. This paper aims at developing a self-learning algorithm using Machine Learning Techniques to detect Ransomware at various stages be it the Initial level, Network level or the Encryption Phase. Our approach (similar to SARVAM-semi-supervised) will be to have pro-active defence or detect early Intrusion. <s> BIB009 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. MACHINE LEARNING-BASED PROPOSALS <s> Ransomware has become a serious and concrete threat for mobile platforms and in particular for Android. In this paper, we propose R-PackDroid, a machine learning system for the detection of Android ransomware. Differently to previous works, we leverage information extracted from system API packages, which allow to characterize applications without specific knowledge of user-defined content such as the application language or strings. Results attained on very recent data show that it is possible to detect Android ransomware and to distinguish it from generic malware with very high accuracy. Moreover, we used R-PackDroid to flag applications that were detected as ransomware with very low confidence by the VirusTotal service. In this way, we were able to correctly distinguish true ransomware from false positives, thus providing valuable help for the analysis of these malicious applications. <s> BIB010 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. MACHINE LEARNING-BASED PROPOSALS <s> Nowadays Ransomwares are not limited to personal computers. Increasing the number of people accessing cell phones, availability of mobile phone application markets along with lack of an effective way for identifying Ransomwares have accelerated their growth and expansion in the field of mobile phones and IOT. In the following article, an optimal approach is presented that transforms the sequence of executable instructions into a grayscale image and then LDA is used in two phases. LDA is a statistical method that is used for separating two or more classes along with dimension reduction. In the first phase, because the image size is large and it contains information that reduces accuracy rate, its best features are exploited using LDA. In the next phase, LDA is fit to train data and the sample tests are feeded for prediction. The experimental results on two well-known Ransomware families and an unknown group of Ransomwares show that the suggested method is capable of identifying with 97 percent of accuracy. <s> BIB011 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. MACHINE LEARNING-BASED PROPOSALS <s> Ransomware remains a modern trend. Attackers are still using cryptovirology forcing victims to pay. Notable attacks have been spreading since 2012, starting with Reveton's ransomware attack to the more recent 2017 WannaCry, Petya and Bad Rabbit cyberattacks. This Ransomware as a Service (RaaS) can lure criminals into developing tools to perform an attack without previous knowledge of the cryptosystem itself. We present in this paper a graph-based ransomware countermeasure to detect malicious threads. It is a new mechanism that doesn't rely on previously used metrics in the literature to detect ransomware such as Shannon's entropy or system calls. An accurate detection is achieved by our solution. The per-thread file system traversal is sufficient to highlight the malicious behaviors. To the best of our knowledge, no previous study has been conducted in this area. The ransomware collection used in our experiments contains more than 700 active examples of ransomware, that were analyzed in our bar metal sandbox environment. <s> BIB012 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. MACHINE LEARNING-BASED PROPOSALS <s> Ransomware has recently (re)emerged as a popular malware that targets a wide range of victims - from individual users to corporate ones for monetary gain. Our key observation on the existing ransomware detection mechanisms is that they fail to provide an early warning in real-time which results in irreversible encryption of a significant number of files while the post-encryption techniques (e.g., key extraction, file restoration) suffer from several limitations. Also, the existing detection mechanisms result in high false positives being unable to determine the original intent of file changes, i.e., they fail to distinguish whether a significant change in a file is due to a ransomware encryption or due to a file operation by the user herself (e.g., benign encryption or compression). To address these challenges, in this paper, we introduce a ransomware detection mechanism, RWGuard, which is able to detect crypto-ransomware in real-time on a user’s machine by (1) deploying decoy techniques, (2) carefully monitoring both the running processes and the file system for malicious activities, and (3) omitting benign file changes from being flagged through the learning of users’ encryption behavior. We evaluate our system against samples from 14 most prevalent ransomware families to date. Our experiments show that RWGuard is effective in real-time detection of ransomware with zero false negative and negligible false positive (\(\sim \)0.1%) rates while incurring an overhead of only \(\sim \)1.9%. <s> BIB013 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. MACHINE LEARNING-BASED PROPOSALS <s> Recent worldwide cybersecurity attacks caused by Cryptographic Ransomware infected systems across countries and organizations with millions of dollars lost in paying extortion amounts. This form of malicious software takes user files hostage by encrypting them and demands a large ransom payment for providing the decryption key. Signature-based methods employed by Antivirus Software are insufficient to evade Ransomware attacks due to code obfuscation techniques and creation of new polymorphic variants everyday. Generic Malware Attack vectors are also not robust enough for detection as they do not completely track the specific behavioral patterns shown by Cryptographic Ransomware families. This work based on analysis of an extensive dataset of Ran-somware families presents RansomWall, a layered defense system for protection against Cryptographic Ransomware. It follows a Hybrid approach of combined Static and Dynamic analysis to generate a novel compact set of features that characterizes the Ransomware behavior. Presence of a Strong Trap Layer helps in early detection. It uses Machine Learning for unearthing zero-day intrusions. When initial layers of RansomWall tag a process for suspicious Ransomware behavior, files modified by the process are backed up for preserving user data until it is classified as Ransomware or Benign. We implemented RansomWall for Microsoft Windows operating system (the most attacked OS by Cryptographic Ransomware) and evaluated it against 574 samples from 12 Cryptographic Ransomware families in real-world user environments. The testing of RansomWall with various Machine Learning algorithms evaluated to 98.25% detection rate and near-zero false positives with Gradient Tree Boosting Algorithm. It also successfully detected 30 zero-day intrusion samples (having less than 10% detection rate with 60 Security Engines linked to VirusTotal). <s> BIB014 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. MACHINE LEARNING-BASED PROPOSALS <s> Ransomware is a type of advanced malware that has spread rapidly in recent years, causing significant financial losses for a wide range of victims, including organizations, healthcare facilities, and individuals. Modern host-based detection methods require the host to be infected first in order to identify anomalies and detect the malware. By the time of infection, it can be too late as some of the system's assets would have been already exfiltrated or encrypted by the malware. Conversely, the network-based methods can be effective in detecting ransomware attacks, as most ransomware families try to connect to command and control servers before their harmful payloads are executed. Therefore, a careful analysis of ransomware network traffic can be one of the key means for early detection. This paper demonstrates a comprehensive behavioral analysis of crypto ransomware network activities, taking Locky, one of the most serious families, as a case study. A dedicated testbed was built, and a set of valuable and informative network features were extracted and classified into multiple types. A network-based intrusion detection system was implemented, employing two independent classifiers working in parallel on different levels: packet and flow levels. The experimental evaluation of the proposed detection system demonstrates that it offers high detection accuracy, low false positive rate, valid extracted features, and is highly effective in tracking ransomware network activities. <s> BIB015 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. MACHINE LEARNING-BASED PROPOSALS <s> With the advent of big data and cloud services, user data has become an important issue. Although a variety of detection and prevention technologies are used to protect user data, ransomware that demands money in exchange for one’s data has emerged. In order to detect and prevent ransomware, file- and behavior-based detection methods have been investigated. Nevertheless, we are still facing from ransomware threats, as it is difficult to detect and prevent ransomware containing unknown malicious codes. In particular, these methods are limited in that they cannot detect ransomware for backup systems such as cloud services. For instance, if files infected with ransomware are synchronized with the backup systems, the infected files will not be able to be restored through the backed-up files. In this paper, we utilize an entropy technique to measure a characteristic of the encrypted file (i.e., uniformity). Machine learning is applied for classifying infected files based file entropy analysis. The proposed method can recover the original file from the backup system by detecting ransomware infected files that have been synchronized to the backup system, even if the user system is infected by ransomware. Conducted analysis results confirm that the proposed method provides a high detection rate with low false positive and false negative rates compared with the existing detection methods. <s> BIB016 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> B. MACHINE LEARNING-BASED PROPOSALS <s> Ransomware can produce direct and controllable economic loss, which makes it one of the most prominent threats in cyber security. As per the latest statistics, more than half of malwares reported in Q1 of 2017 are ransomwares and there is a potent threat of a novice cybercriminals accessing ransomware-as-a-service. The concept of public-key based data kidnapping and subsequent extortion was introduced in 1996. Since then, variants of ransomware emerged with different cryptosystems and larger key sizes, the underlying techniques remained same. Though there are works in literature which proposes a generic framework to detect the crypto ransomwares, we present a two step unsupervised detection tool which when suspects a process activity to be malicious, issues an alarm for further analysis to be carried in the second step and detects it with minimal traces. The two step detection framework- RAPPER uses Artificial Neural Network and Fast Fourier Transformation to develop a highly accurate, fast and reliable solution to ransomware detection using minimal trace points. We also introduce a special detection module for successful identification of disk encryption processes from potential ransomware operations, both having similar characteristics but with different objective. We provide a comprehensive solution to tackle almost all scenarios (standard benchmark, disk encryption and regular high computational processes) pertaining to the crypto ransomwares in light of software security. <s> BIB017
ML techniques differ from combinational methods because they typically use a much larger number of input parameters, a complex combination of them, and automatic training procedures for computing the weights in the combination. The ransomware detection studies based on ML have used mainly supervised learning techniques; however, some unsupervised proposals exist. Continella et al. developed in BIB002 Microsoft Windows kernel modules which monitored process file system actions such as folder listing; files read, renamed, or written; and file entropy in write operations. They collected disk access data from benign applications running on computers from 11 volunteers and ransomware activity data from samples running in a controlled virtualised environment. They observed the data in different time scales to detect ransomware based on short-term and long-term behavioural patterns. The classifier for each scale was the random forest supervised learning algorithm. The EldeRan proposal from BIB003 was based on the application of a supervised regularised logistic regression ML algorithm to a large set of features obtained from static and dynamic analysis of a suspect program. The training phase occurred offline after monitoring goodware and malware software in a sandbox environment. More than 30,000 features were extracted related to Windows API calls, registry key operations, file and directory operations, newly created (dropped) files, and strings present in the binary. Using feature selection based on a mutual information criterion BIB001 , the set was reduced to 400 features while maintaining the best results. In BIB005 , Hasan and Rahman used a Support Vector Machine (SVM) classifier as the machine learning algorithm. More than sixty thousand features were extracted from static and dynamic operations (API calls, registry operations, file system operations, process operations, network actions). Similar to BIB003 , a mutual information criterion was used to reduce the number of features to around 600. In BIB006 Chen et al. obtained more than 70,000 features from the flow graph of API calls used by the suspect process. They applied correlation techniques to reduce the dimensionality and compared the results using a Random Forest, a Support Vector Machine, Simple Logistic algorithm and the Naive Bayes. Meanwhile, 2entFOX from BIB004 used twenty different features, from cryptographic API calls to Windows registry modification, to design a Bayesian network. Lu et al. BIB007 used the V-detector; a negative selection algorithm for classification. This supervised learning algorithm was inspired by the behavior of biological immune systems. The authors used features extracted from the API functions employed, network operations or memory patterns from the ransomware process. The number of features was reduced using a low variance filter, which eliminated features with variances below a given threshold. Vinayakumar et al. BIB008 used the Windows API calls from the process and their frequencies as the sole input features for the ML classifier. Both an SVM classifier and a multilayer perceptron were trained. Chadha and Kumar BIB009 compared the classification results from several supervised and unsupervised algorithms, however, the only feature used as input was the set of domain names generated, trying to detect families of ransomware which used a Domain Generation Algorithm. The proposal from Alam et al. BIB017 was based on the observation of the hardware performance counters present in modern processors. These are special registers that account for the frequency of different machine-level operations taken by the CPU. The goal was to detect high encryption activities based on the CPU events that occurred for these operations. When no ransomware was running, the sampled values from these counters were used for an autoencoder, an artificial neural network used in an unsupervised learning algorithm. No data from ransomware examples were provided in the training phase and their detection was based on detecting an anomaly that deviated from learned behavior. Moussaileb et al. BIB012 analysed the file system traversal action performed by the ransomware to locate files to encrypt. They suggested using decoy (canary) directories, i.e. directories that should not be accessed by benign processes but are a target for ransomware. They compared the classification results from a Random Forest, a decision tree and the k-nearest neighbours algorithm. There have been proposals which have not included every measured feature as an input to the ML algorithm but were designed with a hybrid approach of ML detection, threshold based detection, and ad-hoc mechanisms. For example, Mehnaz et al. BIB013 used an ML algorithm for the classification based on file access primitives (rapidly opened, read and written files). They complemented the detection system with the use of canary files and monitored file encryption as an increase in file-content entropy. They selected a Random Forest classifier after testing other options like Decision Trees, Naive Bayes or Logistic Regression. Proposals like RansomWall BIB014 resorted to a machine learning classification only when a certain number of features were detected in the suspect process. The authors inspected the program binary before execution, checking the use of certain API calls and text strings. They also tracked the access and modifications to canary files and directories. When a certain number of features were present, they used an ML algorithm for the final process classification. They tested the results using supervised algorithms like Logistic Regression, Support Vector Machines, Artificial Neural Networks, Random Forests and Gradient Tree Boosting. Almashhadani et al. BIB015 described a detection system that extracted the features exclusively from network traffic. The authors obtained twenty features from the characteristics of TCP, HTTP and DNS traffic. They built a decision making module based on two classifiers. One classifier was based on per-packet features, while the second one was based on flow-based features. It did not require that both classifiers detected the ransomware. The classifiers evaluated were Random Forests, Bayes Networks, Support Vector Machines and Random Trees. The algorithm that provided the highest accuracy was selected for each classifier. Machine learning algorithms have also been applied to crypto-ransomware detection in the Android operating system. R-PackDroid BIB010 counts the number of uses of different system API packages in the binary program. Based on these data, a Random Forest is used to classify the samples into three possible classes: benign, ransomware or generic malware. Karimi and Moattar's BIB011 ransomware detection method was also based on the analysis of an Android binary. It calculated the proportion of occurrences of each possible operation in the Android Dalvik Opcode language. They used LDA (Latent Dirichlet Allocation) as an image reduction and classification technique. Lee et al. BIB016 used ML techniques to detect encrypted files before they were copied to a backup filesystem. In their proposal, the training phase was implemented at the backup system. It classified files from different users and file types and decided threshold values for file entropy. These thresholds were sent to the client hosts to decide whether a new version of the file was encrypted or not. They used three different methods of entropy computation as input data to the ML algorithm and compared the results from Decision Trees, k-Nearest Neighbours, Kernel Support Vector Machines and the Multi-Layer Perceptron. Some commercial security and backup software solutions have introduced machine learning algorithms into their process. RansomFlare  and Acronis True Image [81] are examples we have found. Although the developers offered little information regarding the tools, in the case of  , we know they were based on the actions performed by the analysed software and on SVM for the classification task.