Crypto-Ransomware: A Revision of the State of the Art, Advances and Challenges

Abstract

According to the premise that the first step to try to solve a problem is to deepen our knowledge of it as much as possible, this work is mainly aimed at diving into and understanding crypto-ransomware, a very present and true-world digital pandemic, from several perspectives. With this aim, this work contributes the following: (a) a review of the fundamentals of this security threat, typologies and families, attack model and involved actors, as well as lifecycle stages; (b) an analysis of the evolution of ransomware in the past years, and the main milestones regarding the development of new variants and real cases that have occurred; (c) a study of the most relevant and current proposals that have appeared to fight against this scourge, as organized in the usual defence lines (prevention, detection, response and recovery); and (d) a discussion of the current trends in ransomware infection and development as well as the main challenges that necessarily need to be dealt with to reduce the impact of crypto-ransomware. All of this will help to better understand the situation and, based on this, will help to develop more adequate defence procedures and effective solutions and tools to defeat attacks.

MIRAD: A Method for Interpretable Ransomware Attack Detection

“…The final, most common, and arguably most harmful type of ransomware is cryptoransomware [2,4]. As the name implies, it encrypts user data, such as work-related and private documents.…”

“…The increasing number of ransomware attacks in recent years has led to a corresponding rise in research dedicated to ransomware detection. The methods can be broadly divided into static, which attempt to recognize ransomware without letting it execute, and dynamic, which focus on monitoring the consequences of executing ransomware [2][3][4]. Both approaches increasingly rely on machine learning, and both work well as complementary methods [6].…”

“…When pursuing this approach, time is of the essence-the faster the detection, the fewer user files will be lost. Optimally, ransomware would be detected before the malware had a chance to commence encryption, i.e., either during staging, when it embeds itself in the system and establishes communications with the outside world, or during scanning, when it searches for user data [2,4,6]. However, if early detection fails, there is value in recognizing the infections even during the encryption stage, since it can limit the number of lost files.…”

“…Similarly, monitoring registry keys provides insight both into ongoing encryption and the early stages of the attack [10]. Other published approaches include measuring file entropy [10], DLLs [11], and network traffic [12], as well as monitoring decoys and traps placed in the file system [4,13]. While they too gave promising results, we chose not to include them to keep our detection system as light as possible while maintaining high prediction accuracy.…”

Cryptocurrency Crime Risks Modeling: Environment, E-Commerce, and Cybersecurity Issue

“…With the widespread adoption of this technology, cybercriminals use forged identities or stolen credit cards to take advantage of free offers to mine cryptocurrencies provided by cloud service providers [13]. Cybercrimes, particularly hacking and ransomware, are associated with cryptocurrencies [14][15][16]. This further complicates the investigation of such crimes, as there is currently no legislation regarding the seizure of virtual assets.…”