Enhancing File Entropy Analysis to Improve Machine Learning Detection Rate of Ransomware

Abstract

Cybersecurity is the biggest threat in the world. More and more people are used to storing personal data on a computer and transmitting it through the Internet. Cybersecurity will be an important issue that everyone continues to pay attention to. One of the most serious problems recently is the prevalence of ransomware, especially crypto-ransomware. Unlike ordinary attacks, crypto-ransomware does not control the victim's computer and steal important data. It focuses on encrypting all data and asking victims to provide ransom to decrypt the data. Currently, many studies focus on various aspects of ransomware, including filebased, behavior-based, and network-based ransomware detection method, and use machine learning to build detection models. In addition to the above research, we found that attackers have begun to develop a new method to encrypt data. It will not only increase the speed of data encryption but also reduce the detection rate in the existing detection system. In any case, we are still facing ransomware dangers, as it is hard to recognize and forestall ransomware executing obscure malicious programs. In other words, user data will be sabotaged as soon as the computer cannot detect the ransomware. To solve the problem, detecting files instead of detecting the executable program might be helpful to establish the backup system immediately before ransomware encrypts all of the user files. We analyze the 22 formats of the encrypted files, extract the specific features and use the Support Vector Machine to distinguish between encrypted and unencrypted files. Conducted analysis results confirm that our method has high performance and can maintain the detection rate of 85.17% (where the detection rate of SVM kernel Trick (Poly) exceeds 92%).

An Effective Strategy for Ransomware Mitigation on Android Devices via Android OS File System API

“…Traditional antivirus solutions have been found somewhat effective but insufficient alone due to the dynamic nature of ransomware attacks [13,32,33]. Combining real-time monitoring with behavior analysis could enhance detection rates [34,28]. Techniques involving the use of sandbox environments to isolate and analyze suspicious applications have shown promise in identifying ransomware before it can cause harm [35].…”

Dynamic Behavioural Analysis of Privacy-Breaching and Data Theft Ransomware

“…However, challenges remain, including the evasion of detection by sophisticated ransomware variants and the resource-intensive nature of maintaining dynamic analysis environments [9], [33]- [37]. Studies highlight the ongoing development of more sophisticated dynamic analysis tools and methods, aiming to improve the detection accuracy and reduce false positives [38], [39]. Yet, the adaptability of ransomware creators means that dynamic analysis must continuously evolve to address new threats.…”

Ransomware Detection Using Machine Learning: A Review, Research Limitations and Future Directions

“…Despite achieving 100% detection accuracy using this method, it's worth noting that the study does not include legitimately encrypted files in their dataset, raising questions about the real-world applicability of their perfect result. Similarly, Hsu et al [88] adopt a comparable approach, utilising entropy to identify files that have already been encrypted by ransomware. They train SVM using 17 filebased features, including the compression ratio of the file and report a detection accuracy of 92% in their experiments.…”