Automated Dynamic Analysis of Ransomware: Benefits, Limitations and use for Detection

Abstract

Recent statistics show that in 2015 more than 140 millions new malware samples have been found. Among these, a large portion is due to ransomware, the class of malware whose specific goal is to render the victim's system unusable, in particular by encrypting important files, and then ask the user to pay a ransom to revert the damage. Several ransomware include sophisticated packing techniques, and are hence difficult to statically analyse. We present EldeRan, a machine learning approach for dynamically analysing and classifying ransomware. EldeRan monitors a set of actions performed by applications in their first phases of installation checking for characteristics signs of ransomware. Our tests over a dataset of 582 ransomware belonging to 11 families, and with 942 goodware applications, show that EldeRan achieves an area under the ROC curve of 0.995. Furthermore, EldeRan works without requiring that an entire ransomware family is available beforehand. These results suggest that dynamic analysis can support ransomware detection, since ransomware samples exhibit a set of characteristic features at run-time that are common across families, and that helps the early detection of new variants. We also outline some limitations of dynamic analysis for ransomware and propose possible solutions.

Cited by in corpus (13)

• A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutions
• Software-Defined Networking-based Crypto Ransomware Detection Using HTTP Traffic Characteristics
• Leveraging Machine Learning Techniques for Windows Ransomware Network Traffic Detection
• Redundancy Coefficient Gradual Up-weighting-based Mutual Information Feature Selection Technique for Crypto-ransomware Early Detection
• Leveraging Support Vector Machine for Opcode Density Based Detection of Crypto-Ransomware
• Towards resilient machine learning for ransomware detection
• Ransomware Analysis using Feature Engineering and Deep Neural Networks
• Deep Learning Based Cryptographic Primitive Classification
• Towards a Resilient Machine Learning Classifier -- a Case Study of Ransomware Detection
• Ransomware in Windows and Android Platforms
• Neurlux: Dynamic Malware Analysis Without Feature Engineering
• Portable, Data-Driven Malware Detection using Language Processing and Machine Learning Techniques on Behavioral Analysis Reports
• Avaddon ransomware: an in-depth analysis and decryption of infected systems