GreatEatlon: Fast, Static Detection of Mobile Ransomware

Abstract

Ransomware is a class of malware that aim at preventing victims from accessing valuable data, typically via data encryption or device locking, and ask for a payment to release the target. In the past year, instances of ransomware attacks have been spotted on mobile devices too. However, despite their relatively low infection rate, we notice that the techniques used by mobile ransomware are quite sophisticated, and di↵erent from those used by ransomware against traditional computers.Through an in-depth analysis of about 100 samples of currently active ransomware apps, we conclude that most of them pass undetected by state-of-the-art tools, which are unable to recognize the abuse of benign features for malicious purposes. The main reason is that such tools rely on an inadequate and incomplete set of features. The most notable examples are the abuse of reflection and device-administration APIs, appearing in modern ransomware to evade analysis and detection, and to elevate their privileges (e.g., to lock or wipe the device). Moreover, current solutions introduce several false positives in the naïve way they detect cryptographic-APIs abuse, flagging goodware apps as ransomware merely because they rely on cryptographic libraries. Last but not least, the performance overhead of current approaches is unacceptable for appstore-scale workloads.In this work, we tackle the aforementioned limitations and propose GreatEatlon, a next-generation mobile ransomware detector. We foresee GreatEatlon deployed on the appstore side, as a preventive countermeasure. At its core, GreatEatlon uses static program-analysis techniques to "resolve" reflection-based, anti-analysis attempts, to recognize abuses of the device administration API, and extract accurate data-flow information required to detect truly malicious uses of cryptographic APIs. Given the significant resources utilized by GreatEatlon, we prepend to its core a fast pre-filter that quickly discards obvious goodware, in order to avoid wasting computer cycles.We tested GreatEatlon on thousands of samples of goodware, generic malware and ransomware applications, and showed that it surpasses current approaches both in speed and detection capabilities, while keeping the false negative rate below 1.3%.

On the effectiveness of system API-related information for Android ransomware detection

“…This tool includes a text classifier (based on NLP features) that works on suspicious strings used by the application, a lightweight smali emulation technique to detect locking strategies, and the application of taint tracking for detecting file-encrypting flows. The system has then been further expanded by Zheng et al with the new name of GreatEatlon and features significant speed improvements, a multiple-classifier system that combines the information extracted by text-and taint-analysis, and so forth [29]. However, despite using features oriented to ransomware detection, the final label provided for each analyzed sample by the released system is only malicious or benign, with no clear decision on the sample being ransomware or not.…”

“…Year Static Dynamic Machine-Learning Available Chen et al (RansomProber) [9] 2018 Cimitille et al (Talos) [11] 2017 Gharib et al (Dna-Droid) [15] 2017 Song et al [24] 2016 Zheng et al (GreatEatlon) [29] 2016 Yang et al [27] 2015 Andronio et al (HelDroid) [3] 2015 from API-calls, permissions and behavioral features [10]. Finally, Ahmadi et al proposed IntelliAV, a generic malware-oriented detector that is publicly available.…”

Ransomware Detection System for Android Applications

“…Zheng et al [27] proposed a preventive countermeasure ransomware detection system called GreatEatlon. GreatEatlon is like an extension from HelDroid [23] with a concentration in crypto ransomware.…”

“…Static analysis was also used to overcome the dynamic analysis issue that many malicious apps are aware of the emulated surroundings and therefore could decide to not exhibit malicious behaviors. Invoking API methods, for example, lockNow() and onDisable() can also be considered as suspicious behavior [23,27]. Other authors [24] tracked the occurrences of inbuilt API packages and accordingly predicted the maliciousness of application.…”

“…Also, the literature counts only a few studies that proposed methods to detect Android ransomware in particular [25]. These research works have approached different static and dynamic methods to detect ransomwares [23,24,26,27].…”