Abstract:Crypto-ransomware remains a significant threat to governments and companies alike, with high-profile cyber security incidents regularly making headlines. Many different detection systems have been proposed as solutions to the ever-changing dynamic landscape of ransomware detection. In the majority of cases, these described systems propose a method based on the result of a single test performed on either the executable code, the process under investigation, its behaviour, or its output. In a small subset of ransomware detection systems, the concept of a scorecard is employed where multiple tests are performed on various aspects of a process under investigation and their results are then analysed using machine learning. The purpose of this paper is to propose a new majority voting approach to ransomware detection by developing a method that uses a cumulative score derived from discrete tests based on calculations using algorithmic rather than heuristic techniques. The paper describes 23 candidate tests, as well as 9 Windows API tests which are validated to determine both their accuracy and viability for use within a ransomware detection system. Using a cumulative score calculation approach to ransomware detection has several benefits, such as the immunity to the occasional inaccuracy of individual tests when making its final classification. The system can also leverage multiple tests that can be both comprehensive and complimentary in an attempt to achieve a broader, deeper, and more robust analysis of the program under investigation. Additionally, the use of multiple collaborative tests also significantly hinders ransomware from masking or modifying its behaviour in an attempt to bypass detection. The results achieved by this research demonstrate that many of the proposed tests achieved a high degree of accuracy in differentiating between benign and malicious targets and suggestions are offered as to how these tests, and combinations of tests, could be adapted to further improve the detection accuracy.

Real-time system call-based ransomware detection

It's too late if exfiltrate: Early stage Android ransomware detection

Detection and Analysis of Android Ransomware Using the Support Vector Machines

Ransomware in Windows and Android Platforms

Cryptographic ransomware encryption detection: Survey

Lightweight Crypto-Ransomware Detection in Android Based on Reactive Honeyfile Monitoring

Ransomware Detection and Classification Strategies

Android ransomware detection using a novel hamming distance based feature selection

Enhanced Android Ransomware Detection Through Hybrid Simultaneous Swarm-Based Optimization

Majority Voting Ransomware Detection System

Crypto-Ransomware and Their Defenses: In-depth Behavioral Characterization, Discussion of Deployability, and New Insights

Limits of I/O Based Ransomware Detection: An Imitation Based Attack.

RAPPER: Ransomware Prevention via Performance Counters

Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System

CanCal: Towards Real-time and Lightweight Ransomware Detection and Response in Industrial Environments

Prediction of android ransomware with deep learning model using hybrid cryptography

Majority Voting Approach to Ransomware Detection

A comprehensive analysis combining structural features for detection of new ransomware families

Malware Detection Approach for Android systems Using System Call Logs

Reviving Android Malware with DroidRide: and How Not To.

Software-Defined Networking-based Crypto Ransomware Detection Using HTTP Traffic Characteristics