Abstract:Ransomware incidents have increased dramatically in the past few years. The number of ransomware variants is also increasing, which means signature and heuristic-based detection techniques are becoming harder to achieve, due to the ever changing pattern of ransomware attack vectors. Therefore, in order to combat ransomware, we need a better understanding on how ransomware is being deployed, its characteristics, as well as how potential victims may react to ransomware incidents. This paper aims to address this challenge by carrying out an investigation on 18 families of ransomware, leading to a model for categorising ransomware behavioural characteristics, which can then be used to improve detection and handling of ransomware incidents. The categorisation was done in respect to the stages of ransomware deployment methods with a predictive model we developed called Randep. The stages are fingerprint, propagate, communicate, map, encrypt, lock, delete and threaten. Analysing the samples gathered for the predictive model provided an insight into the stages and timeline of ransomware execution. Furthermore, we carried out a study on how potential victims (individuals, as well as IT support staff at universities and SMEs) detect that ransomware was being deployed on their machine, what steps they took to investigate the incident, and how they responded to the attack. Both quantitative and qualitative data were collected through questionnaires and in-depth interviews. The results shed an interesting light into the most common attack methods, the most targeted operating systems and the infection symptoms, as well as recommended defence mechanisms. This information can be used in the future to create behavioural patterns for improved ransomware detection and response.

OutletGuarder: Detecting DarkSide Ransomware by Power Factor Correction Signals in an Electrical Outlet

Your Noise, My Signal: Exploiting Switching Noise for Stealthy Data Exfiltration from Desktop Computers

OutletSpy

WattsUpDoc: Power Side Channels to Nonintrusively Discover Untargeted Malware on Embedded Medical Devices

Travelling the Hypervisor and SSD: A Tag-Based Approach Against Crypto Ransomware with Fine-Grained Data Recovery

Power IoT System Security Monitoring Based on Power Consumption Side Channel Information.

Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System

Current Events: Identifying Webpages by Tapping the Electrical Outlet.

Software-Defined Networking-based Crypto Ransomware Detection Using HTTP Traffic Characteristics

Ransomware Detection and Classification Strategies

A comprehensive analysis combining structural features for detection of new ransomware families

Limits of I/O Based Ransomware Detection: An Imitation Based Attack.

Ranker: Early Ransomware Detection Through Kernel-Level Behavioral Analysis

A Study on Countermeasures against Neutralizing Technology: Encoding Algorithm-Based Ransomware Detection Methods Using Machine Learning

A Survey of Machine Learning Algorithms for Detecting Ransomware Encryption Activity

GuardFS: a File System for Integrated Detection and Mitigation of Linux-based Ransomware

An Empirical Study of Data Disruption by Ransomware Attacks

Leveraging Machine Learning Techniques for Windows Ransomware Network Traffic Detection

Effective Ransomware Detection Using Entropy Estimation of Files for Cloud Services

RAPPER: Ransomware Prevention via Performance Counters

Ransomware deployment methods and analysis: views from a predictive model and human responses