On the classification of Microsoft-Windows ransomware using hardware profile

Abstract

Due to the expeditious inclination of online services usage, the incidents of ransomware proliferation being reported are on the rise. Ransomware is a more hazardous threat than other malware as the victim of ransomware cannot regain access to the hijacked device until some form of compensation is paid. In the literature, several dynamic analysis techniques have been employed for the detection of malware including ransomware; however, to the best of our knowledge, hardware execution profile for ransomware analysis has not been investigated for this purpose, as of today. In this study, we show that the true execution picture obtained via a hardware execution profile is beneficial to identify the obfuscated ransomware too. We evaluate the features obtained from hardware performance counters to classify malicious applications into ransomware and non-ransomware categories using several machine learning algorithms such as Random Forest, Decision Tree, Gradient Boosting, and Extreme Gradient Boosting. The employed data set comprises 80 ransomware and 80 non-ransomware applications, which are collected using the VirusShare platform. The results revealed that extracted hardware features play a substantial part in the identification and detection of ransomware with F-measure score of 0.97 achieved by Random Forest and Extreme Gradient Boosting.

Detection of Ransomware Attacks Using Processor and Disk Usage Data

“…Kadiyala et al [12] proposed an HPC-based fine-grained malware detection through a three-step process of extracting HPCs of the system calls, dimensionality reduction, and feeding the components to an ML classifier. Aurangzeb et al [14] tried to identify the difference between ransomware and non-ransomware malware using HPCs data and ML classifiers such as RF, decision trees (DT), gradient boost (GBoost), and extreme gradient boost (XGBoost).…”

“…The data collected using HPCs are frequently used for performance analysis and tuning of the system software. However, several recent research efforts have investigated their use for malware detection [9], [10], [11], [12], [13], [14]. Alam et al [15] utilized HPC data collected for each process running on the system.…”

Efficient Ransomware Detection via Portable Executable File Image Analysis By LLaMA-7b

“…Further advancements in the field have seen the exploration of novel methodologies, such as the application of graph theory [41,42]. This approach involves modeling the intricate relationships within PE files, aiding significantly in the detection of ransomware [9,43].…”

CyberSecurity for Autonomous Vehicles Against Malware Attacks in Smart-Cities

“…The choice of a good feature set is the initial phase of any data mining approach. A few of the extracted features are inspired by previous work [31], [38], however, more features have also been added in this research i.e., hardware performance counters [37], [38], DLLs [52], and strings [16], [31], [53]. We have extracted a total of 1713 features and 10985 features during static and dynamic analysis, respectively.…”

“…However, none of the existing dynamic and ML malware detection techniques use hardware performance counter for malware classification specifically in autonomous vehicles. Although, however, [37] employs a dynamic approach to classify malware based on their hardware performance counters and [38] have used hardware performance counter for ransomware classification on Windows platform.…”