Deep learning LSTM based ransomware detection

Maniath, Sumith; Ashok, Aravind; Poornachandran, Prabaharan; Sujadevi, V. G.; Sankar, A U Prem; Jan, Srinath

doi:10.1109/rdcape.2017.8358312

Cited by 75 publications

(62 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Furthermore based on character level CNN they also proposed a single stage malware classifier. Long-Short Term Memory (LSTM) network was utilized to detecting ransomware in [271]. This proposed network uses binary sequences of API calls made by a process.…”

Section: ) Deep Neural Network (Dnn)mentioning

confidence: 99%

A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security

Ravi¹,

Alazab²,

Sriram³

et al. 2020

Preprint

View full text Add to dashboard Cite

show abstract

Section: ) Deep Neural Network (Dnn)mentioning

confidence: 99%

A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security

Ravi¹,

Alazab²,

Sriram³

et al. 2020

Preprint

View full text Add to dashboard Cite

show abstract

“…The process includes four main phases: (i) raw feature extraction, (ii) preprocessing, (iii) selection, and (iv) analysis through learning algorithms. Moreover, in [27] long-short term memory is used in order to classify a binary sequence of API calls. The feature extraction was done by Cuckoo sandbox capturing API calls, file operations, and registry values.…”

Section: Detection and Predictionmentioning

confidence: 99%

A Survey on Situational Awareness of Ransomware Attacks—Detection and Prevention Parameters

et al. 2019

View full text Add to dashboard Cite

In recent years, cybercrime activities have grown significantly, compromising device security and jeopardizing the normal activities of enterprises. The profits obtained through intimidation and the limitations for tracking down the illegal transactions have created a lucrative business based on the hijacking of users’ files. In this context, ransomware takes advantage of cryptography to compromise the user information or deny access to the operating system. Then, the attacker extorts the victim to pay a ransom in order to regain access, recover the data, or keep the information private. Nowadays, the adoption of Situational Awareness (SA) and cognitive approaches can facilitate the rapid identification of ransomware threats. SA allows knowing what is happening in compromised devices and network communications through monitoring, aggregation, correlation, and analysis tasks. The current literature provides some parameters that are monitored and analyzed in order to prevent these kinds of attacks at an early stage. However, there is no complete list of them. To the best of our knowledge, this paper is the first proposal that summarizes the parameters evaluated in this research field and considers the SA concept. Furthermore, there are several articles that tackle ransomware problems. However, there are few surveys that summarize the current situation in the area, not only regarding its evolution but also its issues and future challenges. This survey also provides a classification of ransomware articles based on detection and prevention approaches.

show abstract

“…This category of ransomware only locks the device without modifying the files contained within the device. Itprevents the victim from accessingit and its system functionalities [1], [6]- [8].…”

Section: Locker Ransomwarementioning

confidence: 99%

“…Application Programming Interface (API) calls are the functions that a program utilizes in its execution. In other words, API calls are a set of routines provided by the OS for build applications, in which each of the API call performs a specific task [1]. APIs helps software programmers to code with ease with the usage of a stable and portable interface without the need to rewrite lower level functions [1].…”

Section: Api Callsmentioning

confidence: 99%

See 1 more Smart Citation

Crypto Ransomware Detection on Windows Operating System

Zakaria,

Abdollah,

Mohd

et al. 2019

IJEAT

View full text Add to dashboard Cite

Crypto-ransomware is a kind of malware threat, and it is one of approach frequently used by cybercriminals. It is due to the capability to hijack the victim’s files and data by totally encrypting it using sophisticated cryptographic libraries such as OpenSSL and Microsoft Cryptography API. From the ransom note left by the attacker on the infected machine, the victim is told to fulfil the requested payment to get back the files. New variants of ransomware were released from time to time, thus making the task of detecting and analyzing it becomes challenging and resource consuming. Obfuscation and polymorphism employed in most modern malware made the task of identifying it even harder. This research investigates the domain of detecting ransomware on a Windows-based platform. We reviewed some of the related works done within this domain. In this research work, we proposed a framework for crypto-ransomware detection on the Windows-based platform by using information such as API calls and registry.

show abstract

Deep learning LSTM based ransomware detection

Cited by 75 publications

References 6 publications

A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security

A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security

A Survey on Situational Awareness of Ransomware Attacks—Detection and Prevention Parameters

Crypto Ransomware Detection on Windows Operating System

Contact Info

Product

Resources

About