Effective Ransomware Detection Using Entropy Estimation of Files for Cloud Services

Lee, Kyungroul; Lee, Sun-Young; Yim, Kangbin

doi:10.3390/s23063023

Cited by 6 publications

(2 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The targeting strategy of ransomware has been another area of focus, as studies have found that ransomware often maps the user environment to identify files of value, paying attention to recent files history and important folders [19,20]. It has been observed that ransomware typically calculates the entropy of file names and contents to determine their authenticity, ignoring files that appear auto-generated, to maximize its impact [21,22].…”

Section: Ransomware Feature Studiesmentioning

confidence: 99%

Ransomware Detection with Opcode Analysis and GAN-Based Unsupervised Learning

Zhong,

Kang

2024

Preprint

View full text Add to dashboard Cite

This study introduces an innovative approach to ransomware detection utilizing opcode analysis combined with Generative Adversarial Networks (GANs). Focusing on the dynamic nature of modern ransomware threats, the research develops a method that leverages unsupervised learning to detect both known and novel ransomware variants. The study begins by examining the evolution of ransomware, from its initial focus on Windows-based systems to the current sophisticated attacks on various platforms. It then explores the implementation of a GAN-based model, capable of discerning ransomware through complex opcode patterns. Experimental results demonstrate the model's effectiveness across several ransomware families, with high accuracy, precision, recall, and F1-scores. The research further delves into the implications of advanced ransomware detection techniques, challenges in adapting to evolving ransomware strategies, the integration of AI in cybersecurity, and future directions in ransomware mitigation. This paper contributes significantly to the field of cybersecurity by providing an advanced, adaptable, and efficient tool for ransomware detection, marking a step forward in combating the increasing ransomware threat.

show abstract

Section: Ransomware Feature Studiesmentioning

confidence: 99%

Ransomware Detection with Opcode Analysis and GAN-Based Unsupervised Learning

Zhong,

Kang

2024

Preprint

View full text Add to dashboard Cite

show abstract

“…[8] introduced strategies aimed at the pre-encryption activities of crypto-ransomware, showing the benefits of early, proactive detection. The study by [41] also underlined the effectiveness of estimating file entropy for early detection in cloud services, pointing out the importance of file analysis in these strategies. In addition, research on employing machine learning for the classification of Bitcoin transactions related to ransomware provides a significant boost to early detection methods, underscoring the importance of early interventions in the fight against ransomware [42].…”

Section: Introductionmentioning

confidence: 96%

An Incremental Mutual Information-Selection Technique for Early Ransomware Detection

Gazzan,

Sheldon

2024

Information

View full text Add to dashboard Cite

Ransomware attacks have emerged as a significant threat to critical data and systems, extending beyond traditional computers to mobile and IoT/Cyber–Physical Systems. This study addresses the need to detect early ransomware behavior when only limited data are available. A major step for training such a detection model is choosing a set of relevant and non-redundant features, which is challenging when data are scarce. Therefore, this paper proposes an incremental mutual information-selection technique as a method for selecting the relevant features at the early stages of ransomware attacks. It introduces an adaptive feature-selection technique that processes data in smaller, manageable batches. This approach lessens the computational load and enhances the system’s ability to quickly adapt to new data arrival, making it particularly suitable for ongoing attacks during the initial phases of the attack. The experimental results emphasize the importance of the proposed technique in estimating feature significance in limited data scenarios. Such results underscore the significance of the incremental approach as a proactive measure in addressing the escalating challenges posed by ransomware.

show abstract

Early mitigation of CPU-optimized ransomware using monitoring encryption instructions

Enomoto,

Kuzuno,

Yamada

et al. 2024

Int. J. Inf. Secur.

View full text Add to dashboard Cite

Ransomware attacks pose a significant threat to information systems. Server hosts, including cloud infrastructure as a service, are prime targets for ransomware developers. To address this, security mechanisms, such as antivirus software, have proven effective. Moreover, research on ransomware detection advocates for behavior-based finding mechanisms while ransomware is in operation. In response to evolving detections, ransomware developers are now adapting an optimized design tailored for CPU architecture (CPU-optimized ransomware). This variant can rapidly encrypt files, potentially evading detection by traditional antivirus methods that rely on fixed time intervals for file scans. In ransomware detection research, numerous files can be encrypted by CPU-optimized ransomware until malicious activity is detected. This study proposes an early mitigation mechanism named CryptoSniffer, which is designed specifically to counter CPU-optimized ransomware attacks on server hosts. CryptoSniffer focuses on the misuse of CPU architecture-specific encryption instructions for swift file encryption by CPU-optimized ransomware. This can be achieved by capturing the ciphertext in user processes and thwarting file encryption by scrutinizing the content intended for writing. To demonstrate the efficacy of CryptoSniffer, the mechanism was implemented in the latest Linux kernel, and its security and performance were systematically evaluated. The experimental results demonstrate that CryptoSniffer successfully prevents real-world CPU-optimized ransomware, and the performance overhead is well-suited for practical applications.

show abstract

Effective Ransomware Detection Using Entropy Estimation of Files for Cloud Services

Cited by 6 publications

References 24 publications

Ransomware Detection with Opcode Analysis and GAN-Based Unsupervised Learning

Ransomware Detection with Opcode Analysis and GAN-Based Unsupervised Learning

An Incremental Mutual Information-Selection Technique for Early Ransomware Detection

Early mitigation of CPU-optimized ransomware using monitoring encryption instructions

Contact Info

Product

Resources

About