Machine Learning Based File Entropy Analysis for Ransomware Detection in Backup Systems

Abstract

With the advent of big data and cloud services, user data has become an important issue. Although a variety of detection and prevention technologies are used to protect user data, ransomware that demands money in exchange for one's data has emerged. In order to detect and prevent ransomware, file-and behavior-based detection methods have been investigated. Nevertheless, we are still facing from ransomware threats, as it is difficult to detect and prevent ransomware containing unknown malicious codes. In particular, these methods are limited in that they cannot detect ransomware for backup systems such as cloud services. For instance, if files infected with ransomware are synchronized with the backup systems, the infected files will not be able to be restored through the backed-up files. In this paper, we utilize an entropy technique to measure a characteristic of the encrypted file (i.e., uniformity). Machine learning is applied for classifying infected files based file entropy analysis. The proposed method can recover the original file from the backup system by detecting ransomware infected files that have been synchronized to the backup system, even if the user system is infected by ransomware. Conducted analysis results confirm that the proposed method provides a high detection rate with low false positive and false negative rates compared with the existing detection methods.

Design of Intrusion Detection Honeypot Using Social Leopard Algorithm to Detect IoT Ransomware Attacks

“…The performance of the IDH is compared with the state of the art Honeypot and ransomware detection systems [20] is shown in Figure 11. In order to measure the efficiency of the proposed IDH and Honeypot, ransomware detection systems [20][14] [23], the same number of samples is tested and validated in both the proposed IDH and Honeypot, ransomware detection systems [20][14] [23]. A confusion matrix is constructed based on the results obtained, and the performance is evaluated based on the accuracy (a ratio of correctly predicted ransomwares to the total number of samples), precision (a ratio of correctly predicted positive ransomwares to the total predicted positive ransomwares) and Recall (a ratio of correctly predicted positive ransomwares to the total number of samples).…”

“…When the CryptoLocker starts to encrypt the files, the Honeyfolder sends an alert regarding the suspicious process and halts the process. Furthermore, to verify the process, the AuditWatch calculates the entropy value [23] for encrypted folders and sends the entropy value to the CEP engine. CEP engine correlates the values from the Honeyfolder, AuditWatch, and SDN application and generates an alert based on an advanced set of rules that provides a high degree of output accuracy.…”

“…It is observed that the proposed IDH outperforms the existing Honeypot and ransomware detection systems [20][14] [23] in terms of detection accuracy. Figure 12 shows that the proposed IDH is cost-efficient and capable of running in a minimal configuration, and the time taken for ransomware detection is reasonable when deployed in IoT platform.…”

Avoiding Future Digital Extortion Through Robust Protection Against Ransomware Threats Using Deep Learning Based Adaptive Approaches

“…Monitoring file in the users' machine [11]- [13] has been used in the literature to detect ransomware [11]. In [11], the authors used an entropy-based technique to compare the status of original files in the backup and an infected file in its current state, thus stopping the synchronization if file is infected. This is an approach which can be considered as a countermeasure, however it has limitation towards the zero-day detection.…”

Optimization of Condition Monitoring Decision Making by the Criterion of Minimum Entropy

“…Initially, only communication theory used the concept of Shannon entropy. However, subsequently, the Shannon entropy began to be used in many different fields of science and technology such as machine learning [2], biomedical informatics [3], reliability [4], prognostics [5], fault detection [6], condition monitoring [7], maintenance [8], fingerprint recognition [9], geosciences [10], fatigue damage modeling [11], and many others.…”