Abstract:Crypto-ransomware remains a significant threat to governments and companies alike, with high-profile cyber security incidents regularly making headlines. Many different detection systems have been proposed as solutions to the ever-changing dynamic landscape of ransomware detection. In the majority of cases, these described systems propose a method based on the result of a single test performed on either the executable code, the process under investigation, its behaviour, or its output. In a small subset of ransomware detection systems, the concept of a scorecard is employed where multiple tests are performed on various aspects of a process under investigation and their results are then analysed using machine learning. The purpose of this paper is to propose a new majority voting approach to ransomware detection by developing a method that uses a cumulative score derived from discrete tests based on calculations using algorithmic rather than heuristic techniques. The paper describes 23 candidate tests, as well as 9 Windows API tests which are validated to determine both their accuracy and viability for use within a ransomware detection system. Using a cumulative score calculation approach to ransomware detection has several benefits, such as the immunity to the occasional inaccuracy of individual tests when making its final classification. The system can also leverage multiple tests that can be both comprehensive and complimentary in an attempt to achieve a broader, deeper, and more robust analysis of the program under investigation. Additionally, the use of multiple collaborative tests also significantly hinders ransomware from masking or modifying its behaviour in an attempt to bypass detection. The results achieved by this research demonstrate that many of the proposed tests achieved a high degree of accuracy in differentiating between benign and malicious targets and suggestions are offered as to how these tests, and combinations of tests, could be adapted to further improve the detection accuracy.

Ranker: Early Ransomware Detection Through Kernel-Level Behavioral Analysis

RiskRanker: scalable and accurate zero-day android malware detection.

A comprehensive analysis combining structural features for detection of new ransomware families

Travelling the Hypervisor and SSD: A Tag-Based Approach Against Crypto Ransomware with Fine-Grained Data Recovery

Leveraging eBPF and AI for Ransomware Nose Out

RAPPER: Ransomware Prevention via Performance Counters

It's too late if exfiltrate: Early stage Android ransomware detection

Ransomware deployment methods and analysis: views from a predictive model and human responses

An Empirical Study of Data Disruption by Ransomware Attacks

Ransomware Analysis using Feature Engineering and Deep Neural Networks

Majority Voting Ransomware Detection System

Limits of I/O Based Ransomware Detection: An Imitation Based Attack.

Ransomware detection based on machine learning using memory features

XRan: Explainable deep learning-based ransomware detection using dynamic analysis

A Survey of Machine Learning Algorithms for Detecting Ransomware Encryption Activity

Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System

Machine Learning-based Ransomware Detection Using Low-level Memory Access Patterns Obtained From Live-forensic Hypervisor

Leveraging Machine Learning Techniques for Windows Ransomware Network Traffic Detection

Majority Voting Approach to Ransomware Detection

Ransomware threat mitigation through network traffic analysis and machine learning techniques

Crypto-Ransomware and Their Defenses: In-depth Behavioral Characterization, Discussion of Deployability, and New Insights