A Survey on Detection Techniques for Cryptographic Ransomware <s> A. INFECTION <s> Attacks over the years have become both increasingly numerous and sophisticated. This paper focuses on the provisioning of a method for the analysis and categorisation of both computer and network attacks, thus providing assistance in combating new attacks, improving computer and network security as well as providing consistency in language when describing attacks. Such a taxonomy is designed to be useful to information bodies such as CERTs (Computer Emergency Response Teams) who have to handle and categorise an every increasing number of attacks on a daily basis. Information bodies could use the taxonomy to communicate more effectively as the taxonomy would provide a common classification scheme. The proposed taxonomy consists of four dimensions which provide a holistic taxonomy in order to deal with inherent problems in the computer and network attack field. The first dimension covers the attack vector and the main behaviour of the attack. The second dimension allows for classification of the attack targets. Vulnerabilities are classified in the third dimension and payloads in the fourth. Finally, to demonstrate the usefulness of this taxonomy, a case study applies the taxonomy to a number of well known attacks. <s> BIB001 </s> A Survey on Detection Techniques for Cryptographic Ransomware <s> A. INFECTION <s> Smartphones have become pervasive due to the availability of office applications, Internet, games, vehicle guidance using location-based services apart from conventional services such as voice calls, SMSes, and multimedia services. Android devices have gained huge market share due to the open architecture of Android and the popularity of its application programming interface (APIs) in the developer community. Increased popularity of the Android devices and associated monetary benefits attracted the malware developers, resulting in big rise of the Android malware apps between 2010 and 2014. Academic researchers and commercial antimalware companies have realized that the conventional signature-based and static analysis methods are vulnerable. In particular, the prevalent stealth techniques, such as encryption, code transformation, and environment-aware approaches, are capable of generating variants of known malware. This has led to the use of behavior-, anomaly-, and dynamic-analysis-based methods. Since a single approach may be ineffective against the advanced techniques, multiple complementary approaches can be used in tandem for effective malware detection. The existing reviews extensively cover the smartphone OS security. However, we believe that the security of Android, with particular focus on malware growth, study of antianalysis techniques, and existing detection methodologies, needs an extensive coverage. In this survey, we discuss the Android security enforcement mechanisms, threats to the existing security enforcements and related issues, malware growth timeline between 2010 and 2014, and stealth techniques employed by the malware authors, in addition to the existing detection methods. This review gives an insight into the strengths and shortcomings of the known research methodologies and provides a platform, to the researchers and practitioners, toward proposing the next-generation Android security, analysis, and malware detection techniques. <s> BIB002
The infection step (Step 1) is carried out following the same procedures as any other malware. The main infection vectors are: • Spam: The malware reaches the user through unsolicited e-mail. It contains the malware as an attached file. The content and subject of the e-mail try to be related to personal or work activities (requests from friends, rebates, invoices). • Corrupted web pages: A web page containing benign files is hacked by the malware author. The files offered for download (software updates, documents) are substituted for the malware. The user downloads and executes the malware while believing it is a benign document. • Vulnerabilities: The hacker benefits from vulnerabilities in the user operating system or web browser to deliver and run the malware to the host. • Phishing: The content of an e-mail, web page or the interlocutor on a phone call impersonate a company, friend, colleague or public service to take the user to a fake web page and to download and run the malware. Figure 2 shows the distribution of the infection vector for ransomware strains described in Table 1 [22]-  . We refer to the literature BIB001 , BIB002 for further detail.