Data Aware Defense (DaD): Towards a Generic and Practical Ransomware Countermeasure

Abstract

Abstract. We present the Malware -O -Matic analysis platform and the Data Aware Defense ransomware countermeasure based on real time data gathering with as little impact as possible on system performance. Our solution monitors (and blocks if necessary) file system activity of all userland threads with new indicators of compromise. We successfully detect 99.37% of our 798 active ransomware samples with at most 70 MB lost per sample's thread in 90% of cases, or less than 7 MB in 70% of cases. By a careful analysis of the few false negatives we show that some ransomware authors are specifically trying to hide ongoing encryption. We used free (as in free beer) de facto industry standard benchmarks to evaluate the impact of our solution and enable fair comparisons. In all but the most demanding tests the impact is marginal.

A Roadmap for Improving the Impact of Anti-ransomware Research

“…In order to achieve detection, some Data Source is required along with the Processing of this data. The data source used for a given detection technique may require access to Kernel Space (such as in Data Aware Defense [22]), User Space (such as in RAPPER [23]) or both (such as in UNVEIL [20]). Additionally, any results from the raw data sources or the data processing steps could optionally be fed into Machine Learning algorithms in order to detect subtle patterns in the data to build models to distinguish between benign and malicious behaviour (as in ShieldFS [19]).…”

Discriminating Unknown Software Using Distance Model

“…This paper improves our first countermeasure presented in [1], which targets crypto-ransomware. The main idea is that encrypted data is indistinguishable from perfectly random data.…”

Ransomware Network Traffic Analysis for Pre-encryption Alert

“…A high detection rate was achieved by their solution: 99.95%. A similar approach is used by Palisse et al, however, using the goodness-of-fit test to distinguish between encrypted and non encrypted files achieving 99.3% true positive rate [30].…”