A Survey on Detection Techniques for Cryptographic Ransomware <s> A. COMBINATIONAL TECHNIQUES <s> In ransomware attacks, the actual target is the human, as opposed to the classic attacks that abuse the infected devices e.g., botnet renting, information stealing. Mobile devices are by no means immune to ransomware attacks. However, there is little research work on this matter and only traditional protections are available. Even state-of-the-art mobile malware detection approaches are ineffective against ransomware apps because of the subtle attack scheme. As a consequence, the ample attack surface formed by the billion mobile devices is left unprotected. ::: ::: First, in this work we summarize the results of our analysis of the existing mobile ransomware families, describing their common characteristics. Second, we present HelDroid, a fast, efficient and fully automated approach that recognizes known and unknown scareware and ransomware samples from goodware. Our approach is based on detecting the "building blocks" that are typically needed to implement a mobile ransomware application. Specifically, HelDroid detects, in a generic way, if an app is attempting to lock or encrypt the device without the user's consent, and if ransom requests are displayed on the screen. Our technique works without requiring that a sample of a certain family is available beforehand. ::: ::: We implemented HelDroid and tested it on real-world Android ransomware samples. On a large dataset comprising hundreds of thousands of APKs including goodware, malware, scareware, and ransomware, HelDroid exhibited nearly zero false positives and the capability of recognizing unknown ransomware samples. <s> BIB001 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> A. COMBINATIONAL TECHNIQUES <s> Ransomware is a growing threat that encrypts auser's files and holds the decryption key until a ransom ispaid by the victim. This type of malware is responsible fortens of millions of dollars in extortion annually. Worse still, developing new variants is trivial, facilitating the evasion of manyantivirus and intrusion detection systems. In this work, we presentCryptoDrop, an early-warning detection system that alerts a userduring suspicious file activity. Using a set of behavior indicators, CryptoDrop can halt a process that appears to be tampering witha large amount of the user's data. Furthermore, by combininga set of indicators common to ransomware, the system can beparameterized for rapid detection with low false positives. Ourexperimental analysis of CryptoDrop stops ransomware fromexecuting with a median loss of only 10 files (out of nearly5,100 available files). Our results show that careful analysis ofransomware behavior can produce an effective detection systemthat significantly mitigates the amount of victim data loss. <s> BIB002 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> A. COMBINATIONAL TECHNIQUES <s> Attacks of Ransomware are increasing, this form of malware bypasses many technical solutions by leveraging social engineering methods. This means established methods of perimeter defence need to be supplemented with additional systems. Honeypots are bogus computer resources deployed by network administrators to act as decoy computers and detect any illicit access. This study investigated whether a honeypot folder could be created and monitored for changes. The investigations determined a suitable method to detect changes to this area. This research investigated methods to implement a honeypot to detect ransomware activity, and selected two options, the File Screening service of the Microsoft File Server Resource Manager feature and EventSentry to manipulate the Windows Security logs. The research developed a staged response to attacks to the system along with thresholds when there were triggered. The research ascertained that witness tripwire files offer limited value as there is no way to influence the malware to access the area containing the monitored files. <s> BIB003 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> A. COMBINATIONAL TECHNIQUES <s> TorrentLocker is a ransomware that encrypts sensitive data located on infected computer systems. Its creators aim to ransom the victims, if they want to retrieve their data. Unfortunately, antiviruses have difficulties to detect such polymorphic malware. In this paper, we propose a novel approach to detect online suspicious processes accessing a large number of files and encrypting them. Such a behavior corresponds to the classical scenario of a malicious ransomware. We show that the Kullback-Liebler divergence can be used to detect with high effectiveness whether a process transforms structured input files (such as JPEG files) into unstructured encrypted files, or not. We focus mainly on JPEG files since irreplaceable pictures represent in many cases the most valuable data on personal computers or smartphones. <s> BIB004 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> A. COMBINATIONAL TECHNIQUES <s> Due to recent indiscriminate attacks of ransomware, damage cases including encryption of users’ important files are constantly increasing. The existing vaccine systems are vulnerable to attacks of new pattern ransomware because they can only detect the ransomware of existing patterns. More effective technique is required to prevent modified ransomware. In this paper, an effective method is proposed to prevent the attacks of modified ransomware on Android platform. The proposed technique specifies and intensively monitors processes and specific file directories using statistical methods based on Processor usage, Memory usage, and I/O rates so that the process with abnormal behaviors can be detected. If the process running a suspicious ransomware is detected, the proposed system will stop the process and take steps to confirm the deletion of programs associated with the process from users. The information of suspected and exceptional processes confirmed by users is stored in a database. The proposed technique can detect ransomware even if you do not save its patterns. Its speed of detection is very fast because it can be implemented in Android source code instead of mobile application. In addition, it can effectively determine modified patterns of ransomware and provide protection with minimum damage. <s> BIB005 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> A. COMBINATIONAL TECHNIQUES <s> Ransomware is a form of extortion-based attack that locks the victim’s digital resources and requests money to release them. The recent resurgence of high-profile ransomware attacks, particularly in critical sectors such as the health care industry, has highlighted the pressing need for effective defenses. While users are always advised to have a reliable backup strategy, the growing number of paying victims in recent years suggests that an endpoint defense that is able to stop and recover from ransomware’s destructive behavior is needed. <s> BIB006 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> A. COMBINATIONAL TECHNIQUES <s> Abstract Crypto ransomware is a type of malware that locks access to user files by encrypting them and demands a ransom in order to obtain the decryption key. This type of malware has become a serious threat for most enterprises. In those cases where the infected computer has access to documents in network shared volumes, a single host can lock access to documents across several departments in the company. We propose an algorithm that can detect ransomware action and prevent further activity over shared documents. The algorithm is based on the analysis of passively monitored traffic by a network probe. 19 different ransomware families were used for testing the algorithm in action. The results show that it can detect ransomware activity in less than 20 s, before more than 10 files are lost. Recovery of even those files was also possible because their content was stored in the traffic monitored by the network probe. Several days of traffic from real corporate networks were used to validate a low rate of false alarms. This paper offers also analytical models for the probability of early detection and the probability of false alarms for an arbitrarily large population of users. <s> BIB007 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> A. COMBINATIONAL TECHNIQUES <s> In recent years, we witnessed a drastic increase of ransomware, especially on popular mobile platforms including Android. Ransomware extorts victims for a sum of money by taking control of their devices or files. In light of their rapid growth, there is a pressing need to develop effective countermeasure solutions. However, the research community is still constrained by the lack of a comprehensive data set, and there exists no insightful understanding of mobile ransomware in the wild. In this paper, we focus on the Android platform and aim to characterize existing Android ransomware. Specifically, we have managed to collect 2,721 ransomware samples that cover the majority of existing Android ransomware families. Based on these samples, we systematically characterize them from several aspects, including timeline and malicious features. In addition, the detection results of existing anti-virus tools are rather disappointing, which clearly calls for customized anti-mobile-ransomware solutions. To detect ransomware that extorts users by encrypting data, we propose a novel real-time detection system, called RansomProber. By analyzing the user interface widgets of related activities and the coordinates of users' finger movements, RansomProber can infer whether the file encryption operations are initiated by users. The experimental results show that RansomProber can effectively detect encrypting ransomware with high accuracy and acceptable runtime performance. <s> BIB008
Most parameters described in Section 3 alone can result in the erroneous judgement of benign software as ransomware. For example, a process that encrypts files can be legitimate, but the function calls it uses may result in its classification as ransomware. A program that accesses many files and removes them like malware may be a harmless compression utility. A program that overwrites a large number of files may be a photo edition tool applying a filter to a set of images. However, a program that accesses many files spread throughout many different directories and removing them and creating new files with random-looking content is less likely to be benign software (although it still may be). The more actions taken into account and the more of them present in malware activity, the higher the successful identification rate. However, collecting all these actions requires giving permission to the malware to run freely for a long time, long enough to encrypt and destroy several files. The ransomware detection proposals presented in this section are a combination of a subset of parameters from those described in Section III and Figure 4 . These parameters provide a numerical measure of software dynamic activity. These measurements are combined to create a single value that characterises process activity. Based on predetermined thresholds for this combined measurement or for each value, the process can be labelled as benign or ransomware. Scaife et al. described in BIB002 software that measured disk access actions from each process while it was running. The analysis software grouped its input measurement parameters into primary and secondary indicators, being the three primary indicators more reliable for malware identification. All primary indicators must occur for the process to be classified as ransomware. As primary indicators, it used the identification of changes in file format (based on the ''file'' utility and the ''magic bytes''), a quantitative comparison of the original and modified files, and an entropy measurement of the created files. The secondary indicators were the number of files deleted and the diversity of types in files read by the process. The risk evaluation for a process was incremented with time as a process performs actions in some of these parameters classified as dangerous. When this risk value reached a certain threshold, an alert was triggered and disk access was blocked for the process. However, there was no description of the determination of the threshold values. Paik et al.  investigated the special behaviour of Solid State Disks (SSDs) where the data were not deleted when overwritten; they were deleted later, on a garbage collection action. They suggested introducing in SSDs the measurement of read-and-rewrite and deletion requests, and comparing the ratio of these actions to a threshold to detect a ransomware attack. They did not provide details regarding the dynamic measurement, threshold computation, or evaluation of the achievable results. The anti-ransomware software described by Kharraz and Kirda in BIB006 was based on at least half a dozen input parameters related to the disk access actions performed by a process. From a file content perspective, it measured the variation in entropy from a read to a write request in the same section of a file; it also monitored the proportion of file content overwritten and whether the process deleted files. The solution presented also collected metadata information regarding disk access actions. It checked whether a process accessed a large number of files with write privileges and whether the accessed files were from very different file types (from very different applications) or from the same one. In addition, it monitored the time between write requests and assigned a larger risk value the shorter the time. All these measured process features were combined to offer a risk assessment using a linear function. The weights in this function were determined by recursive feature elimination. Moore BIB003 set a honeypot where file changes were monitored and different levels of alarm were triggered based on the threshold reached. Parameter and threshold configuration was obtained from the average normal activity over a day; however, no description was provided as to the determination of normal activity. The threshold values simply doubled normal average values. No validation against real ransomware was provided. The method presented by Mbol et al. BIB004 restricted vigilance to image files (JPEG format). It measured the number of image files opened and the difference between the read and written versions. JPEG format contains compression characteristics, making it difficult to differentiate from an encrypted file using, for example, the entropy value of file content. The proposal used the Kullback-Lieber divergence to compare an original file and a possibly encrypted file. The thresholds for ransomware detection were decided by trial and error using TorrentLocker as the ransomware under analysis. In BIB007 , we measured network traffic between an infected computer and network shared volumes by measuring the number of bytes read and written as well as file content destroyed. These values are combined and checked against thresholds precomputed to achieve 100% identification for the available ransomware samples and minimum false positive events in the case of benign activity in a real scenario. The previous proposals targeted the Microsoft Windows environment, while Song et al. BIB005 , Andronio et al. BIB001 , and Chen et al. BIB008 focused on ransomware detection in an Android cell phone operating system. The HelDroid proposal of Andronio et al. BIB001 combined the detection of threatening text in the binary or network traffic with a static analysis of the software searching for file access followed by encryption and deletion. This was combined with heuristics attempting to detect procedures to lock access to the device. In BIB005 , Song et al. suggested monitoring any activity on a set of protected files, warning the user when a non-authorised process attempted to access any of those files. It also monitored CPU, memory, and disk usage, warning the user when a threshold was exceeded. No information was provided regarding how the time-varying statistical measurements should be taken or the thresholds computed. The proposal from Chen et al. BIB008 differed substantially. It was based on the monitoring of written files and detecting whether they were encrypted using the computation of file content entropy. Once a new encryption process was detected, the user interface was analysed to determine whether it was the result of user actions or unknown to the user and therefore the result of encrypting ransomware.