Ransomware deployment methods and analysis: views from a predictive model and human responses

Abstract

Ransomware incidents have increased dramatically in the past few years. The number of ransomware variants is also increasing, which means signature and heuristic-based detection techniques are becoming harder to achieve, due to the ever changing pattern of ransomware attack vectors. Therefore, in order to combat ransomware, we need a better understanding on how ransomware is being deployed, its characteristics, as well as how potential victims may react to ransomware incidents. This paper aims to address this challenge by carrying out an investigation on 18 families of ransomware, leading to a model for categorising ransomware behavioural characteristics, which can then be used to improve detection and handling of ransomware incidents. The categorisation was done in respect to the stages of ransomware deployment methods with a predictive model we developed called Randep. The stages are fingerprint, propagate, communicate, map, encrypt, lock, delete and threaten. Analysing the samples gathered for the predictive model provided an insight into the stages and timeline of ransomware execution. Furthermore, we carried out a study on how potential victims (individuals, as well as IT support staff at universities and SMEs) detect that ransomware was being deployed on their machine, what steps they took to investigate the incident, and how they responded to the attack. Both quantitative and qualitative data were collected through questionnaires and in-depth interviews. The results shed an interesting light into the most common attack methods, the most targeted operating systems and the infection symptoms, as well as recommended defence mechanisms. This information can be used in the future to create behavioural patterns for improved ransomware detection and response. which permits unrestricted use, distribution, and reproduction in any medium, provided you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made.

An economic analysis of ransomware and its welfare consequences

“…nomoreransom.org/). Naturally, after the widely reported 'success' of Cryptolocker, there has been an explosion in the number of ransomware strands [21,22]. There are now readily available development kits selling in the black market alongside Ransomware-as-a-Service (RaaS).…”

Ransomware Prevention and Mitigation Techniques

“…Therefore, the main contribution of Hull et al [25] is a predictive model for categorizing ransomware behavioral characteristics, which can then be used to ameliorate uncovering and dealing with ransomware incidents. The categorization was done with respect to the deployment stages of ransomware, by establishing a predictive model called "Randep".…”

Ransomware and Reputation

“…Broadly speaking, ransomware is a form of malware in which the victim of a cyber-attack is blackmailed. The term has recently become synonymous with crypto-ransomware wherein the files on a victims device are encrytped and a ransom is demanded for the key to decrypt those files [1][2][3][4]. While ransomware dates back to the AIDS Trojan in 1989, it has come to prominence over the last five years or so with an explosion in the number of ransomware strands and victims [5].…”

“…Recent evidence suggests that victims who pay the ransom recover their data around 50% of the time [14]. 1 That may be enough to tempt victims to try their luck and pay up. So, have the criminals, consciously or not, hit upon a good strategy?…”

“…In Section 2 we provide the model, in Section 3 we have our results, and in Section 4 we conclude. 1 Although it is not clear whether this is some criminals returning the files 100% of the time and some 0% of the time, or it is mixing by a particular criminal.…”