Automated Ransomware Behavior Analysis: Pattern Extraction and Early Detection

Abstract

Security operation centers (SOCs) typically use a variety of tools to collect large volumes of host logs for detection and forensic of intrusions. Our experience, supported by recent user studies on SOC operators, indicates that operators spend ample time (e.g., hundreds of man hours) on investigations into logs seeking adversarial actions. Similarly, reconfiguration of tools to adapt detectors for future similar attacks is commonplace upon gaining novel insights (e.g., through internal investigation or shared indicators). This paper presents an automated malware pattern-extraction and early detection tool, testing three machine learning approaches: TF-IDF (term frequencyinverse document frequency), Fisher's LDA (linear discriminant analysis) and ET (extra trees/extremely randomized trees) that can (1) analyze freshly discovered malware samples in sandboxes and generate dynamic analysis reports (host logs); (2) automatically extract the sequence of events induced by malware given a large volume of ambient (un-attacked) host logs, and the relatively few logs from hosts that are infected with potentially polymorphic malware; (3) rank the most discriminating features (unique patterns) of malware and from the behavior learned detect malicious activity, and (4) allows operators to visualize the discriminating features and their correlations to facilitate malware forensic efforts. To validate the accuracy and efficiency of our tool, we design three experiments and test seven ransomware attacks (i.e., WannaCry, DBGer, Cerber, Defray, GandCrab, Locky, and nRansom). The experimental results show that TF-IDF is the best of the three methods to identify discriminating features, and ET is the most time-efficient and robust approach.

Security Awareness on Ransomware Threats Detection and their Protection Techniques

“…Yassine Lemmou and El Mamoun Souidi [10] published a deep analysis over the behavior of Gandcrab ransomware on 2 subversions (v1.0 and v2.2r) out of 7 (v1.0, v1.1, v2.1, v2.1r, v2.2r, v2.3r, and v2.3.1r) subversions while Oleg Kolesnikov [17] mentioned the v4.1 has detected in July 2018 and it reached up to v5.2 March 2019 and observed all the versions have same payload with little changes. Gandcrab owner mentioned that they ceased their business on June 2019 [21]. Gandcrab kill the running process to avoid detection except antivirus, monitoring tools and some programs of operating system.…”

“…Reference [18] referred malicious sites as first step to start of ransomware kill chain. According to [19] CryptoWall, PrincessLocker and CryptXXX while in [21] GandCrab uses this method to deliver attack.…”

“…Qian Chen et al [21] designed a tool, which extracts patterns of malware and performs early detection. They mentioned in their research that manually analysis of malware is time killing and not as much accurate as designed tool.…”

Avoiding Future Digital Extortion Through Robust Protection Against Ransomware Threats Using Deep Learning Based Adaptive Approaches

“…However, setting a fixed time is not applicable to all ransomware samples, since some variants exhibit their malicious activities after human interaction or discovering the executing environment. Machine learning-based methods have also been applied by the researchers in [34]. They have applied TF-IDF, Fisher's LDA and ET as machine learning method to detect ransomware.…”

Automated Analysis Approach for the Detection of High Survivable Ransomware

“…Selecting the most relevant subset features from the original features can improve classifier performance and the accuracy of classification operation [41,45,40]; hence, the effective feature set was identified using term weight as the criterion of feature selection. We applied term frequency-inverse document frequency (TF-IDF) feature selection method for setting the weight to a term based on its inverse document frequency and evaluating how important feature is a document in the collection [36]. The purpose of using TF-IDF weighting is to eliminate those features that occur commonly in many vectors while giving more attention to features that are less frequent in the vectors.…”