Ransomware: Recent advances, analysis, challenges and future research directions

Abstract

The COVID-19 pandemic has witnessed a huge surge in the number of ransomware attacks. Different institutions such as healthcare, financial, and government have been targeted. There can be numerous reasons for such a sudden rise in attacks, but it appears working remotely in home-based environments (which is less secure compared to traditional institutional networks) could be one of the reasons. Cybercriminals are constantly exploring different approaches like social engineering attacks, such as phishing attacks, to spread ransomware. Hence, in this paper, we explored recent advances in ransomware prevention and detection and highlighted future research challenges and directions. We also carried out an analysis of a few popular ransomware samples and developed our own experimental ransomware, AESthetic, that was able to evade detection against eight popular antivirus programs.

Online Security Attack Experience and Worries of Young Adults in the United Kingdom

“…This showed that people who were more confident in their ability to identify security threats were less worried about phishing attacks. 1 Principal Components Analysis is a technique to reduce a number of variables to the set which describes the data in the smallest possible number of variables with the least loss of information. It is a non-parametric analysis method.…”

Ransomware Detection in Cyber Security Domain

“…Beama et al discussed the analysis of ransomware attacks based on the challenges, recent advances as well as future research directions [16]. The paper stated that static analysis is mostly evaded by code obfuscation techniques.…”

Machine Learning-based Ransomware Detection Using Low-level Memory Access Patterns Obtained From Live-forensic Hypervisor

“…• We developed a thin and lightweight live-forensic hypervisor that collects low-level memory access patterns with mitigating advanced evasion techniques of malware that exploit OS vulnerabilities. • While many modern ransomware detection methods presented in literature use dynamic features obtained from an operating system layer [2] (e.g., sequences of API calls per process ID, file system operations), our system uses only low-level memory access patterns of physical address space obtained from a hypervisor layer. • Many researchers believe that Virtual Machine Introspection (VMI), in general, needs to bridge the semantic gap between OS and hypervisor [8].…”

“…Although anti-virus software vendors frequently update their signature database used to detect binary files of the variants, the signature-based static analysis detection fundamentally cannot cope with a large number of the variants. Beaman et al presented a literature review on recent state-of-the-art ransomware prevention and detection approaches [2]. They analyzed popular ransomware samples and developed their experimental ransomware, AESthetic, that was able to evade detection against eight popular antivirus programs.…”