Ransomware Evolution, Growth and Recommendation for Detection

Abstract

Ransomware is a malicious program that can affect any person or organization. Ransomware is a complicated malicious attack that aims at lock or encrypt user files. Up to this date, there is no individual method, tool, which guarantee to protect against ransomware. Most tools available can detect some types of ransomware but it fails to detect other types of ransomware. In this research author talks about several methods, tools, procedures which can be taken to reduce the possibility of ransomware occurrences. Up to this moment, the main methods used by attacker to infect your machine are malicious emails and malicious links. After analyzing several reports written by some anti-viruses’ company such as Kaspersky ,McAfee, and several researches which talks about ransomware, author conclude two points: first point, educating users, following up a strict security policy, procedures and backup strategies are the best methods which can be taken to minimize the possibility of ransomware. second point, future methods to detect ransomware mainly will be based on artificial intelligence.

Mitigating Sodinokibi Ransomware Attack on Cloud Network Using Software-Defined Networking (SDN)

“…Mohammad, in his research, explained two independent classifiers in reducing Crypto-Ransomware attacks, namely: first, user training, security policy, and data backup. Secondly, the detection system uses artificial intelligence [11]. Chakkaravarthy et al use the Intrusion Detection Honeypot (IDH) and Social Leopard Algorithm systems to detect Ransomware attacks through an early warning on the user's system against suspicious file activity [15].…”

“…Based on the mitigation process, the infected machine allows for data repair and recovery. The sixth stage of the result obtained in mitigation is the percentage value of relief applied, updating system detection, ransomware, and network security knowledge [11].…”

“…Finally, the fourth stage spreads advanced infections to his other computers. Based on this, the importance of mitigating because the excess of this virus can apply widespread attack expansion through the same network traffic and can operate without having to connect to the command and control server [9][10][11].…”

ESCAPADE: Encryption-Type-Ransomware: System Call Based Pattern Detection

“…With the growing numbers of mobile devices, ransomware, such as Wan-naLocker, SimpleLocker, Filecoder, and Black Rose Lucy [17,30], have found their way into the mobile ecosystem. Ransomware are generally of two types: locker ransomware and encryption ransomware [33]. Locker-type ransomware traditionally displays a persistent screen that prevents the user from interacting with the rest of the system.…”

Android Ransomware Detection Based on a Hybrid Evolutionary Approach in the Context of Highly Imbalanced Data

“…Ransomware developers have diversely created well-established methods to cause monetary damages to their victims. Consequently, this type of malware has constituted as one of the most threatening attacks targeting both individuals and organizations with financial losses to billions of dollars, which harmed one million Android users in one month [5], [6]. Additionally, Ransomware's recent success results in the manifestation of new families [4].…”