A Digital DNA Sequencing Engine for Ransomware Detection Using Machine Learning

Khan, Firoz; Ncube, Cornelius; Ramasamy, Lakshmana Kumar; Kadry, Seifedine; Nam, Yunyoung

doi:10.1109/access.2020.3003785

Cited by 78 publications

(52 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Khan et al [21] have proposed a digital DNA sequencing engine for ransomware detection using Naive Bayes, Decision stump, and AdaBoost algorithms for classification. The features are obtained from the pre-processed data using Multi-Objective Grey Wolf Optimization (MOGWO) and Binary Cuckoo Search (BCS) algorithms.…”

Section: Literature Reviewmentioning

confidence: 99%

Analysis of Crypto-Ransomware Using ML-Based Multi-Level Profiling

Poudyal¹,

Dasgupta

2021

IEEE Access

View full text Add to dashboard Cite

Crypto-ransomware is the most prevalent form of modern malware, has affected various industries, demanding a significant amount of ransom. Mainly, small businesses, healthcare, education, and government sectors have been under continuous attacks by these adversaries. Various static and dynamic analysis techniques exist, but these methods become less efficient as the malware writers continuously trick the defenders. Numerous research of ransomware with AI techniques often lack the behavioral analysis and its correlation mapping. In this work, we developed an AI-powered hybrid approach overcoming the recent challenges to detect ransomware. Specifically, we proposed a deep inspection approach for multi-level profiling of crypto-ransomware, which captures the distinct features at Dynamic link library, function call, and assembly levels. We showed how the code segments correlate at these levels for studied samples. Our hybrid multi-level analysis approach includes advanced static and dynamic methods and a novel strategy of analyzing behavioral chains with AI techniques. Moreover, association rule mining, natural language processing techniques, and machine learning classifiers are integrated for building ransomware validation and detection model. We experimented with crypto-ransomware samples (collected from VirusTotal). One of the machine learning algorithms achieved the highest accuracy of 99.72% and a false positive rate of 0.003 with two class datasets. The result exhibited that multi-level profiling can better detect ransomware samples with higher accuracy. The multi-level feature sequence can be extracted from most of the applications running in the different operating systems; therefore, we believe that our method can detect ransomware for devices on multiple platforms. We designed a prototype, AIRaD (AI-based Ransomware Detection) tool, which will allow researchers and the defenders to visualize the analysis with proper interpretation.

show abstract

Section: Literature Reviewmentioning

confidence: 99%

Analysis of Crypto-Ransomware Using ML-Based Multi-Level Profiling

Poudyal¹,

Dasgupta

2021

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Code obfuscation makes it difficult to detect based on code. It is known that only portions of code are revealed during certain parts of executions [21].…”

Section: Digital Dna Sequencingmentioning

confidence: 99%

“…The novelty of this study is the use of digital DNA sequencing, a synthetic DNA representation of a digital artefact rather than biological DNA. A digital artefact is represented by only the characters A, G, C, T, where adenine (A), guanine (G), cytosine (C), and thymine (T) molecules, commonly referred to as "bases" [21]. An example of this process of converting a regular dataset to a DNA sequence is: a sample with the binary features '0 1 0 0 0 1 0 1 0 1 0' would be converted to 'CGAACGCGCG' which is a digital DNA sequence containing features from the "bases".…”

Section: Digital Dna Sequencingmentioning

confidence: 99%

“…Early ransomware detection is relative; early detection can be defined as identifying an infected machine and preventing the infection from spreading across the network or can be defined as identifying a ransomware executable in the earliest stages of its execution before encryption. Early Detection solutions, like Reference [10,16,21,39], are critical in ransomware detection and will be critical in ransomware detection going forward. The early detection approach is important because of the damage ransomware can do to a system and businesses.…”

Section: New Directions/ransomware Evolutionmentioning

confidence: 99%

See 1 more Smart Citation

A Study on the Evolution of Ransomware Detection Using Machine Learning and Deep Learning Techniques

Fernando

Komninos

2020

IoT

View full text Add to dashboard Cite

This survey investigates the contributions of research into the detection of ransomware malware using machine learning and deep learning algorithms. The main motivations for this study are the destructive nature of ransomware, the difficulty of reversing a ransomware infection, and how important it is to detect it before infecting a system. Machine learning is coming to the forefront of combatting ransomware, so we attempted to identify weaknesses in machine learning approaches and how they can be strengthened. The threat posed by ransomware is exceptionally high, with new variants and families continually being found on the internet and dark web. Recovering from ransomware infections is difficult, given the nature of the encryption schemes used by them. The increase in the use of artificial intelligence also coincides with this boom in ransomware. The exploration into machine learning and deep learning approaches when it comes to detecting ransomware poses high interest because machine learning and deep learning can detect zero-day threats. These techniques can generate predictive models that can learn the behaviour of ransomware and use this knowledge to detect variants and families which have not yet been seen. In this survey, we review prominent research studies which all showcase a machine learning or deep learning approach when detecting ransomware malware. These studies were chosen based on the number of citations they had by other research. We carried out experiments to investigate how the discussed research studies are impacted by malware evolution. We also explored the new directions of ransomware and how we expect it to evolve in the coming years, such as expansion into IoT (Internet of Things), with IoT being integrated more into infrastructures and into homes.

show abstract

“…There are two types of ransomware: Locker [24] and Crypto-ransomware [2] [15]. Locker ransomware locks the entire system and denies access to the system, whereas the crypto-ransomware encrypts the user files and denies access to the user files in the system [25]. Locker is a common variant used in most IoT ransomware, locking the entire device and denying access.…”

Section: Introductionmentioning

confidence: 99%

Design of Intrusion Detection Honeypot Using Social Leopard Algorithm to Detect IoT Ransomware Attacks

et al. 2020

View full text Add to dashboard Cite

In recent times, ransomware has become the most significant cyber-attack targeting individuals, enterprises, healthcare industries, and the Internet of Things (IoT). Existing security systems like Intrusion Detection and Prevention System (IDPS) and Anti-virus (AV) as a single monitoring agent is complicated and timeconsuming, thus fails in ransomware detection. A robust Intrusion Detection Honeypot (IDH) is proposed to address the issues mentioned above. IDH consists of i) Honeyfolder, ii) Audit Watch, and iii) Complex Event Processing (CEP). Honeyfolder is a decoy folder modeled using Social Leopard Algorithm (SoLA), especially for getting attacked and acting as an early warning system to alert the user during the suspicious file activities. AuditWatch is an Entropy module that verifies the entropy of the files and folders. CEP engine is used to aggregate data from different security systems to confirm the ransomware behavior, attack pattern, and promptly respond to them. The proposed IDH is experimentally tested in a secured testbed using more than 20 variants of recent ransomware of all types. The experimental result confirms that the proposed IDH significantly improves the ransomware detection time, rate, and accuracy compared with the existing state of the art ransomware detection model.

show abstract

A Digital DNA Sequencing Engine for Ransomware Detection Using Machine Learning

Cited by 78 publications

References 20 publications

Analysis of Crypto-Ransomware Using ML-Based Multi-Level Profiling

Analysis of Crypto-Ransomware Using ML-Based Multi-Level Profiling

A Study on the Evolution of Ransomware Detection Using Machine Learning and Deep Learning Techniques

Design of Intrusion Detection Honeypot Using Social Leopard Algorithm to Detect IoT Ransomware Attacks

Contact Info

Product

Resources

About