A New Static-Based Framework for Ransomware Detection

Medhat, May; Gaber, Samir; Abdelbaki, Nashwa

doi:10.1109/dasc/picom/datacom/cyberscitec.2018.00124

Cited by 25 publications

(14 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Rule-Based Detection YARA rules are created by the rule-based ransomware detection system of Medhat et al [126] using API calls of ile and cryptography libraries, strings, and ile extensions from ransomware binaries. Using the YARA scanner, their system scans each sample, and assigns a score based on the existence of these features in the samples.…”

Section: Ransomware Detection For Pcs/worktationsmentioning

confidence: 99%

A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutions

et al. 2022

View full text Add to dashboard Cite

In recent years, ransomware has been one of the most notorious malware targeting end-users, governments, and business organizations. It has become a very profitable business for cybercriminals with revenues of millions of dollars, and a very serious threat to organizations with financial loss of billions of dollars. Numerous studies were proposed to address the ransomware threat, including surveys that cover certain aspects of ransomware research. However, no study exists in the literature that gives the complete picture on ransomware and ransomware defense research with respect to the diversity of targeted platforms. Since ransomware is already prevalent in PCs/workstations/desktops/laptops, is becoming more prevalent in mobile devices, and has already hit IoT/CPS recently, and will likely grow further in the IoT/CPS domain very soon, understanding ransomware and analyzing defense mechanisms with respect to target platforms is becoming more imperative. In order to fill this gap and motivate further research, in this paper, we present a comprehensive survey on ransomware and ransomware defense research with respect to PCs/workstations, mobile devices, and IoT/CPS platforms. Specifically, covering 137 studies over the period of 1990-2020, we give a detailed overview of ransomware evolution, comprehensively analyze the key building blocks of ransomware, present a taxonomy of notable ransomware families, and provide an extensive overview of ransomware defense research (i.e., analysis, detection, and recovery) with respect to platforms of PCs/workstations, mobile devices, and IoT/CPS. Moreover, we derive an extensive list of open issues for future ransomware research. We believe this survey will motivate further research by giving a complete picture on state-of-the-art ransomware research.

show abstract

Section: Ransomware Detection For Pcs/worktationsmentioning

confidence: 99%

A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutions

et al. 2022

View full text Add to dashboard Cite

show abstract

“…Medhat et al present a static-based framework having a multi-level alert system to detect ransomware [91]. Their work relies on the concept of shared patterns/code among ransomware that represents static features.…”

Section: Signature Based Detection (Sbd)mentioning

confidence: 99%

A Survey on Windows-based Ransomware Taxonomy and Detection Mechanisms

et al. 2021

View full text Add to dashboard Cite

Ransomware remains an alarming threat in the 21st century. It has evolved from being a simple scare tactic into a complex malware capable of evasion. Formerly, end-users were targeted via mass infection campaigns. Nevertheless, in recent years, the attackers have focused on targeted attacks, since the latter are profitable and can induce severe damage. A vast number of detection mechanisms have been proposed in the literature. We provide a systematic review of ransomware countermeasures starting from its deployment on the victim machine until the ransom payment via cryptocurrency. We define four stages of this malware attack: Delivery, Deployment, Destruction, and Dealing. Then, we assign the corresponding countermeasures for each phase of the attack and cluster them by the techniques used. Finally, we propose a roadmap for researchers to fill the gaps found in the literature in ransomware’s battle.

show abstract

“…Rule-Based Detection YARA rules are created by the rule-based ransomware detection system of Medhat et al [127] using API calls of file and cryptography libraries, strings, and file extensions from ransomware binaries. Using the YARA scanner, their system scans each sample, and assigns a score based on the existence of these features in the samples.…”

Section: Ransomware Detection For Pcs/worktationsmentioning

confidence: 99%

A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutions

Oz,

Aris,

Levi

et al. 2021

Preprint

View full text Add to dashboard Cite

In recent years, ransomware has been one of the most notorious malware targeting end users, governments, and business organizations. It has become a very profitable business for cybercriminals with revenues of millions of dollars, and a very serious threat to organizations with financial loss of billions of dollars. Numerous studies were proposed to address the ransomware threat, including surveys that cover certain aspects of ransomware research. However, no study exists in the literature that gives the complete picture on ransomware and ransomware defense research with respect to the diversity of targeted platforms. Since ransomware is already prevalent in PCs/workstations/desktops/laptops, is becoming more prevalent in mobile devices, and has already hit IoT/CPS recently, and will likely grow further in the IoT/CPS domain very soon, understanding ransomware and analyzing defense mechanisms with respect to target platforms is becoming more imperative. In order to fill this gap and motivate further research, in this paper, we present a comprehensive survey on ransomware and ransomware defense research with respect to PCs/workstations, mobile devices, and IoT/CPS platforms. Specifically, covering 137 studies over the period of 1990-2020, we give a detailed overview of ransomware evolution, comprehensively analyze the key building blocks of ransomware, present a taxonomy of notable ransomware families, and provide an extensive overview of ransomware defense research (i.e., analysis, detection, and recovery) with respect to platforms of PCs/workstations, mobile devices, and IoT/CPS. Moreover, we derive an extensive list of open issues for future ransomware research. We believe this survey will motivate further research by giving a complete picture on state-of-the-art ransomware research. CCS Concepts: • Security and privacy → Malware and its mitigation.

show abstract

A New Static-Based Framework for Ransomware Detection

Cited by 25 publications

References 15 publications

A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutions

A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutions

A Survey on Windows-based Ransomware Taxonomy and Detection Mechanisms

A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutions

Contact Info

Product

Resources

About