Abstract:Ransomware attacks have escalated recently and are affecting essential infrastructure and enterprises across the globe. Unfortunately, ransomware uses sophisticated encryption techniques to encrypt important files on the targeted machine and then demands payment to decrypt the data. Artificial intelligent techniques including machine learning have been increasingly applied in the field of cybersecurity and greatly contributed to detecting and preventing different kinds of attacks However, the number of studies that applied machine learning to detect ransomware are still limited by the obfuscation of malware, the lack of setting up a proper analysis environment, the accuracy of models, and the high false-positive rate. Thus, it is crucial to develop effective ransomware detection based on machine learning techniques. This study aims to build a robust machine-learning model that can recognize unknown samples using memory dumps to detect ransomware with high accuracy and minimal false positives providing an extensive analysis of how memory traces can assist in the detection of ransomware. This goal was achieved by building a new dataset composed of recent ransomware group attack samples like Revil, Lockbit, and BlackCat, as well as a number of benign samples, including office applications, Windows applications, and compression applications, which were dynamically analyzed within an enhanced cuckoo sandbox to ensure the most reliable results. Then, a set of machine learning models were developed, and a comparative performance analysis was conducted. Among the various models evaluated, XGBoost was the best-performing model, using only 47 features out of 58. It achieved 97.85% accuracy with a 2% false positive rate.

Travelling the Hypervisor and SSD: A Tag-Based Approach Against Crypto Ransomware with Fine-Grained Data Recovery

RSSD: Defend against Ransomware with Hardware-Isolated Network-Storage Codesign and Post-Attack Analysis

A Content-based Ransomware Detection and Backup Solid-State Drive for Ransomware Defense

GuardFS: a File System for Integrated Detection and Mitigation of Linux-based Ransomware

An Empirical Study of Data Disruption by Ransomware Attacks

KEY-SSD: Access-Control Drive to Protect Files from Ransomware Attacks

Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System

Fight Malware Like Malware: A New Defense Method Against Crypto Ransomware

Limits of I/O Based Ransomware Detection: An Imitation Based Attack.

Early mitigation of CPU-optimized ransomware using monitoring encryption instructions

WannaLaugh: A Configurable Ransomware Emulator -- Learning to Mimic Malicious Storage Traces

Crypto-Ransomware and Their Defenses: In-depth Behavioral Characterization, Discussion of Deployability, and New Insights

MTFS: a Moving Target Defense-Enabled File System for Malware Mitigation

Ransomware Reloaded: Re-examining Its Trend, Research and Mitigation in the Era of Data Exfiltration

A comprehensive analysis combining structural features for detection of new ransomware families

Software-Defined Networking-based Crypto Ransomware Detection Using HTTP Traffic Characteristics

Ransomware threat mitigation through network traffic analysis and machine learning techniques

Machine Learning-based Ransomware Detection Using Low-level Memory Access Patterns Obtained From Live-forensic Hypervisor

A Comprehensive Analysis of Machine Learning Based File Trap Selection Methods to Detect Crypto Ransomware

Entropy Sharing in Ransomware: Bypassing Entropy-Based Detection of Cryptographic Operations

Ransomware detection based on machine learning using memory features