Prevention of Crypto-Ransomware Using a Pre-Encryption Detection Algorithm

Abstract

Ransomware is a relatively new type of intrusion attack, and is made with the objective of extorting a ransom from its victim. There are several types of ransomware attacks, but the present paper focuses only upon the crypto-ransomware, because it makes data unrecoverable once the victim’s files have been encrypted. Therefore, in this research, it was proposed that machine learning is used to detect crypto-ransomware before it starts its encryption function, or at the pre-encryption stage. Successful detection at this stage is crucial to enable the attack to be stopped from achieving its objective. Once the victim was aware of the presence of crypto-ransomware, valuable data and files can be backed up to another location, and then an attempt can be made to clean the ransomware with minimum risk. Therefore we proposed a pre-encryption detection algorithm (PEDA) that consisted of two phases. In, PEDA-Phase-I, a Windows application programming interface (API) generated by a suspicious program would be captured and analyzed using the learning algorithm (LA). The LA can determine whether the suspicious program was a crypto-ransomware or not, through API pattern recognition. This approach was used to ensure the most comprehensive detection of both known and unknown crypto-ransomware, but it may have a high false positive rate (FPR). If the prediction was a crypto-ransomware, PEDA would generate a signature of the suspicious program, and store it in the signature repository, which was in Phase-II. In PEDA-Phase-II, the signature repository allows the detection of crypto-ransomware at a much earlier stage, which was at the pre-execution stage through the signature matching method. This method can only detect known crypto-ransomware, and although very rigid, it was accurate and fast. The two phases in PEDA formed two layers of early detection for crypto-ransomware to ensure zero files lost to the user. However in this research, we focused upon Phase-I, which was the LA. Based on our results, the LA had the lowest FPR of 1.56% compared to Naive Bayes (NB), Random Forest (RF), Ensemble (NB and RF) and EldeRan (a machine learning approach to analyze and classify ransomware). Low FPR indicates that LA has a low probability of predicting goodware wrongly.

Intrusion Detection Method Based on Adaptive Clonal Genetic Algorithm and Backpropagation Neural Network

“…e algorithm can effectively reduce the false alarm rate and network delay, but in real-time detection, the detection efficiency of the algorithm needs to be improved. In [21], a preencryption detection algorithm is proposed to detect encrypted ransomware. Compared with some algorithms based on machine learning, it is found that the proposed preencryption algorithm has better performance and a lower false alarm rate.…”

Securing Software Systems - A Survey

“…Developing a software from scratch is comparable to reinventing the wheel by many, hence solutions are offered to secure existing software systems. Some to name are Component-Based Software Engineering (CBSE), use of authentication schemes, systematic frameworks, graphical authentication models for mobile devices and applications [8], specialized attack detection techniques [9], etc. CBSE helps in minimizing the efforts of building a software system by reusing the components, "component dependency and component interaction" [10].…”

Ransomware Prevention and Mitigation Techniques

“…Furthermore, it shows that ransomware may be identified using individual or shared patterns. Furthermore, Kok et al [14] proposed a pre-encryption algorithm that composed of two phases the first, is a machine learning algorithm used to detect the ransomware before encrypting user files, which based on API pattern recognition. Hence, it uses Cuckoo sandbox to captures the (API) generated by the suspicious program and analyzes them, but it may have a high false positive rate.…”