Detection of Ransomware Attacks Using Processor and Disk Usage Data

Abstract

Ransomware often evades antivirus tools, encrypts files, and renders the target computer and its data unusable. The current approaches to detect such ransomware include monitoring processes, system calls, and file activities on the target system and analyzing the data collected. Monitoring multiple processes has a very high overhead; newer ransomware may interfere with the monitoring and corrupt the collected data. This paper presents a robust and practical approach to detecting ransomware in execution on a virtual machine (VM). We collect data for selected processor and disk I/O events for the entire VM from the host machine and use a machine learning (ML) classifier to develop a detection model. This approach avoids the overhead of continuously monitoring every process on the target machine and prevents the risk of data contamination by ransomware. Furthermore, it is resilient to variations in user workloads. It provides fast detection with a high probability for known (used for training the ML model) and unknown (not used for training) ransomware. The random forest (RF) classifier performed the best of the seven ML classifiers we tested. Over six different user loads and 22 ransomware, the RF model detected ransomware within 400 milliseconds with a 0.98 probability.

Deep learning-powered malware detection in cyberspace: a contemporary review

“…The field of deep learning-powered malware detection encompasses various challenges and solutions [118][119][120][121][122][123]. One significant challenge is handling 0-day attacks, as deep learning models traditionally rely on historical data and struggle against novel, unseen threats [124][125][126][127][128].…”

LLaMa Assisted Reverse Engineering of Modern Ransomware: A Comparative Analysis with Early Crypto-Ransomware

“…Particularly, studies have shown that ransomware frequently encrypts files using advanced algorithms and communicates with remote servers for instructions or data transmission [1]. This dynamic scrutiny has been instrumental in formulating more effective incident response strategies by identifying unique characteristics and tactics of ransomware, including evasion techniques to bypass traditional security measures [34,35]. Additionally, the analysis has played a crucial role in tracking the evolution of ransomware, highlighting how these threats adapt and find new ways to evade detection [36,37].…”

“…This method monitors changes in files and directories during an attack, helping identify specific encryption techniques [40]. Hardware statistics such as CPU Hardware Performance Counters (HPCs) are also utilized to detect anomalous patterns indicative of ransomware, as encryption processes typically lead to a spike in CPU usage [5,40,39,34]. Memory usage analysis is another critical aspect, in which by examining the memory footprint and access patterns of processes, it is possible to detect ransomware that encrypts files in memory before writing to disk, identifying more sophisticated, in-memory encryption techniques [35,36].…”

“…Memory usage analysis is another critical aspect, in which by examining the memory footprint and access patterns of processes, it is possible to detect ransomware that encrypts files in memory before writing to disk, identifying more sophisticated, in-memory encryption techniques [35,36]. Network activity analysis, tracking both incoming and outgoing traffic, plays a vital role in identifying ransomware communications with command and control servers, including data uploads which might signal data exfiltration [34,35].…”

“…Despite these methods forming a comprehensive approach to understanding and combating ransomware, dynamic analysis has its inadequacies [3]. Its reliance on observable behaviors means that highly sophisticated ransomware, employing advanced evasion or stealth techniques, can sometimes evade detection [34,35]. Furthermore, dynamic analysis requires the actual execution of ransomware, which can be risky and potentially lead to data loss or system compromise [36].…”