A Survey on Detection Techniques for Cryptographic Ransomware <s> C. AD-HOC PROPOSALS <s> Attacks of Ransomware are increasing, this form of malware bypasses many technical solutions by leveraging social engineering methods. This means established methods of perimeter defence need to be supplemented with additional systems. Honeypots are bogus computer resources deployed by network administrators to act as decoy computers and detect any illicit access. This study investigated whether a honeypot folder could be created and monitored for changes. The investigations determined a suitable method to detect changes to this area. This research investigated methods to implement a honeypot to detect ransomware activity, and selected two options, the File Screening service of the Microsoft File Server Resource Manager feature and EventSentry to manipulate the Windows Security logs. The research developed a staged response to attacks to the system along with thresholds when there were triggered. The research ascertained that witness tripwire files offer limited value as there is no way to influence the malware to access the area containing the monitored files. <s> BIB001 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> C. AD-HOC PROPOSALS <s> Currently, different forms of ransomware are increasingly threatening Internet users. Modern ransomware encrypts important user data, and it is only possible to recover it once a ransom has been paid. In this article we show how software-defined networking can be utilized to improve ransomware mitigation. In more detail, we analyze the behavior of popular ransomware — CryptoWall — and, based on this knowledge, propose two real-time mitigation methods. Then we describe the design of an SDN-based system, implemented using OpenFlow, that facilitates a timely reaction to this threat, and is a crucial factor in the case of crypto ransomware. What is important is that such a design does not significantly affect overall network performance. Experimental results confirm that the proposed approach is feasible and efficient. <s> BIB002 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> C. AD-HOC PROPOSALS <s> Ransomware is a very effective form of malware that is recently spreading out on an impressive number of workstations and smartphones. This malware blocks the access to the infected machine or to the files located in the infected machine. The attackers will restore the machine and files only after the payment of a certain amount of money, usually given in the form of bitcoins. Commercial solutions are still ineffective to recognize the last variants of ransomware, and the problem has been poorly investigated in literature. In this paper we discuss a methodology based on formal methods for detecting ransomware malware on Android devices. We have implemented our method in a tool named Talos. We evaluate the method, and the obtained results show that Talos is very effective in recognizing ransomware (accuracy of 0.99) even when it is obfuscated (accuracy still remains at 0.99). <s> BIB003 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> C. AD-HOC PROPOSALS <s> Ransomware is the most threatening malware which expects payment at the stake of your personal files/folders. Ransomware has been found in Windows, IOS, Android and even in Linux too. And none of them was able to protect its users from its threat. Many detection techniques and analysis tools have been developed to detect ransomware virus. According to the Verizon named American company's report, ransomware hit financial services, healthcare and public sector the most. Verizon also found that small and medium-sized businesses are now the main target of cyber criminals. So, in this paper, we have provided an extension to static text analysis so as to make it powerful. Ransomware attack its users by either by either blocking the screen or by encrypting user data. We try and provide leverage to the user by providing hardware interaction that allows the users to uninstall harmful applications by pressing the power button multiple times. To overcome data encryption, we allow the user to select the directories that contain important data, and as soon as new file is added to any of these directories, we upload the file on an online server, thus enabling the user to maintain a safe copy of all important data. <s> BIB004 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> C. AD-HOC PROPOSALS <s> Recent worldwide cybersecurity attacks caused by Cryptographic Ransomware infected systems across countries and organizations with millions of dollars lost in paying extortion amounts. This form of malicious software takes user files hostage by encrypting them and demands a large ransom payment for providing the decryption key. Signature-based methods employed by Antivirus Software are insufficient to evade Ransomware attacks due to code obfuscation techniques and creation of new polymorphic variants everyday. Generic Malware Attack vectors are also not robust enough for detection as they do not completely track the specific behavioral patterns shown by Cryptographic Ransomware families. This work based on analysis of an extensive dataset of Ran-somware families presents RansomWall, a layered defense system for protection against Cryptographic Ransomware. It follows a Hybrid approach of combined Static and Dynamic analysis to generate a novel compact set of features that characterizes the Ransomware behavior. Presence of a Strong Trap Layer helps in early detection. It uses Machine Learning for unearthing zero-day intrusions. When initial layers of RansomWall tag a process for suspicious Ransomware behavior, files modified by the process are backed up for preserving user data until it is classified as Ransomware or Benign. We implemented RansomWall for Microsoft Windows operating system (the most attacked OS by Cryptographic Ransomware) and evaluated it against 574 samples from 12 Cryptographic Ransomware families in real-world user environments. The testing of RansomWall with various Machine Learning algorithms evaluated to 98.25% detection rate and near-zero false positives with Gradient Tree Boosting Algorithm. It also successfully detected 30 zero-day intrusion samples (having less than 10% detection rate with 60 Security Engines linked to VirusTotal). <s> BIB005 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> C. AD-HOC PROPOSALS <s> Ransomware remains a modern trend. Attackers are still using cryptovirology forcing victims to pay. Notable attacks have been spreading since 2012, starting with Reveton's ransomware attack to the more recent 2017 WannaCry, Petya and Bad Rabbit cyberattacks. This Ransomware as a Service (RaaS) can lure criminals into developing tools to perform an attack without previous knowledge of the cryptosystem itself. We present in this paper a graph-based ransomware countermeasure to detect malicious threads. It is a new mechanism that doesn't rely on previously used metrics in the literature to detect ransomware such as Shannon's entropy or system calls. An accurate detection is achieved by our solution. The per-thread file system traversal is sufficient to highlight the malicious behaviors. To the best of our knowledge, no previous study has been conducted in this area. The ransomware collection used in our experiments contains more than 700 active examples of ransomware, that were analyzed in our bar metal sandbox environment. <s> BIB006 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> C. AD-HOC PROPOSALS <s> Ransomware has recently (re)emerged as a popular malware that targets a wide range of victims - from individual users to corporate ones for monetary gain. Our key observation on the existing ransomware detection mechanisms is that they fail to provide an early warning in real-time which results in irreversible encryption of a significant number of files while the post-encryption techniques (e.g., key extraction, file restoration) suffer from several limitations. Also, the existing detection mechanisms result in high false positives being unable to determine the original intent of file changes, i.e., they fail to distinguish whether a significant change in a file is due to a ransomware encryption or due to a file operation by the user herself (e.g., benign encryption or compression). To address these challenges, in this paper, we introduce a ransomware detection mechanism, RWGuard, which is able to detect crypto-ransomware in real-time on a user’s machine by (1) deploying decoy techniques, (2) carefully monitoring both the running processes and the file system for malicious activities, and (3) omitting benign file changes from being flagged through the learning of users’ encryption behavior. We evaluate our system against samples from 14 most prevalent ransomware families to date. Our experiments show that RWGuard is effective in real-time detection of ransomware with zero false negative and negligible false positive (\(\sim \)0.1%) rates while incurring an overhead of only \(\sim \)1.9%. <s> BIB007 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> C. AD-HOC PROPOSALS <s> Abstract Ransomware has become a pandemic nowadays. Although some proposals exist to fight against this increasing type of extortion, most of them are prevention like and rely on the assumption that early detection is not so effective once the victim is infected. This paper presents a novel approach intended not just to early detect ransomware but to completely thwart its action. For that, a set of honeyfiles is deployed around the target environment in order to catch the ransomware. Instead of being normal archives, honeyfiles are FIFO like, so that the ransomware is blocked once it starts reading the file. In addition to frustrate its action, our honeyfile solution is able to automatically launch countermeasures to solve the infection. Moreover, as it does not require previous training or knowledge, the approach allows fighting against unknown, zero-day ransomware related attacks. As a proof of concept, we have developed the approach for Linux platforms. The tool, named R-Locker , shows excellent performance both from the perspective of its accuracy as well as in terms of complexity and resource consumption. In addition, it has no special needs or privileges and does not affect the normal operation of the overall environment. <s> BIB008
The proposals of the studies in this section used the knowledge of specific behaviour in ransomware samples and are valid only for a few ransomware families. In some cases, they measured sufficient software characteristics to take into account different behaviours. Static analysis of a binary in search of specific patterns is the most usual form of malware fingerprinting. In the Android operating system, Cimitile et al. BIB003 offered a new approach, transforming Java bytecode into formal models and constructing temporal logic properties to describe the characteristic behaviour of a ransomware. The solutions of Kanwal et al. BIB004 were based on searching for specific static text strings in the binary, which can be indicative of a ransom request screen. Canary files, decoy files, or honeyfiles have been used in several of the above-mentioned proposals BIB005 , BIB001 , BIB006 ,  , BIB007 ,  , BIB008 . In BIB008 , canary files were the only detection technique proposed. Commercial ransomware detection tools such as CryptoStopper  are based on canary files, while others [87] monitor the extensions of newly created files in search of those used by known ransomware variants. Studies by Cabaj and Mazurczyk BIB002 or by Ahmadian et al.  were based on detecting and blocking the communication to the ransomware C&C servers. Cabaj and Mazurczyk BIB002 used OpenFlow-capable switches to intercept or monitor DNS requests which were checked against a blacklist of known C&C domain names. The proposal of Ahmadian et al.  accommodated ransomware families which generated pseudo-random domain names. It attempted to detect DNS requests to names generated by a DGA based on a Markov chain and a model for the frequency of alphabetic characters and character transitions. Commercial offerings such as Cisco Umbrella  are also based on DNS inspection and domain blacklisting.