Machine Learning in Automated Detection of Ransomware: Scope, Benefits and Challenges

Thangapandian, Vani

doi:10.1007/978-3-030-93453-8_15

Cited by 3 publications

(7 citation statements)

References 92 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The development of advanced tools and methodologies that can detect subtle anomalies and patterns indicative of ransomware activity is now a necessity [14,21]. This study serves as a call to action for cybersecurity professionals and researchers to rethink and retool their strategies in the face of this evolving digital menace [15,37,7].…”

Section: Interpretation Of the Resultsmentioning

confidence: 99%

“…As ransomware continues to evolve in complexity, the role of advanced computational models and algorithms in detecting and analyzing these threats becomes increasingly significant [31]. Future studies should focus on refining these AI-driven techniques, enhancing their accuracy, and reducing the level of subjectivity in their interpretation, thus pushing the boundaries of current cybersecurity capabilities [37,15,12,1,28].…”

Section: Limitations Of the Studymentioning

confidence: 99%

“…This dynamic scrutiny has been instrumental in formulating more effective incident response strategies by identifying unique characteristics and tactics of ransomware, including evasion techniques to bypass traditional security measures [34,35]. Additionally, the analysis has played a crucial role in tracking the evolution of ransomware, highlighting how these threats adapt and find new ways to evade detection [36,37].…”

Section: Ransomware Dynamic Analysismentioning

confidence: 99%

“…Furthermore, dynamic analysis requires the actual execution of ransomware, which can be risky and potentially lead to data loss or system compromise [36]. Another significant gap in current research is the lack of standardized frameworks for dynamic analysis across different environments and ransomware variants [37,3]. This inconsistency challenges the generalizability of findings and hampers the development of universally effective defense strategies.…”

Section: Ransomware Dynamic Analysismentioning

confidence: 99%

“…This inconsistency challenges the generalizability of findings and hampers the development of universally effective defense strategies. Consequently, future research must focus on enhancing detection capabilities for advanced evasion techniques, developing safer analysis environments, and standardizing analysis protocols to ensure broader applicability and effectiveness in combating ransomware threats [37,3,31].…”

Section: Ransomware Dynamic Analysismentioning

confidence: 99%

See 4 more Smart Citations

LLaMa Assisted Reverse Engineering of Modern Ransomware: A Comparative Analysis with Early Crypto-Ransomware

Vasconcelos,

Almeida

2023

Preprint

View full text Add to dashboard Cite

The evolution of ransomware from crypto-ransomware to sophisticated data theft ransomware presents new challenges in cybersecurity. This study investigates the strategic shift in ransomware tactics, emphasizing covert communication and advanced data exfiltration methods. Utilizing the LLaMa-12B model and IDA Pro for reverse engineering, the research delves into the operational intricacies of contemporary ransomware, contrasting recent data theft variants like AlphV and Black Basta with early crypto-ransomware examples like TeslaCrypt and WannaCry. The findings highlight the necessity for adaptive cybersecurity strategies, incorporating advanced detection systems to recognize ransomware activities. The study underscores the importance of expanding research to a broader range of ransomware samples and integrating AI and machine learning technologies for a comprehensive understanding of these evolving threats. The limitations, primarily the research's focus on specific ransomware samples and the subjective interpretation of the LLaMa-12B model's analysis, are acknowledged. Future research should aim to refine AI-driven techniques and develop standardized analysis frameworks, enhancing the effectiveness of cybersecurity defenses against ransomware.

show abstract

Section: Interpretation Of the Resultsmentioning

confidence: 99%

Section: Limitations Of the Studymentioning

confidence: 99%

Section: Ransomware Dynamic Analysismentioning

confidence: 99%

Section: Ransomware Dynamic Analysismentioning

confidence: 99%

Section: Ransomware Dynamic Analysismentioning

confidence: 99%

See 3 more Smart Citations

LLaMa Assisted Reverse Engineering of Modern Ransomware: A Comparative Analysis with Early Crypto-Ransomware

Vasconcelos,

Almeida

2023

Preprint

View full text Add to dashboard Cite

show abstract

Ransomware Detection Using Machine Learning: A Review, Research Limitations and Future Directions

Ispahany,

Islam,

Islam

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Ransomware attacks are on the rise in terms of both frequency and impact. The shift to remote work due to the COVID-19 pandemic has led more people to work online, prompting companies to adapt quickly. Unfortunately, this increased online activity has provided cybercriminals numerous opportunities to carry out devastating attacks. One recent method employed by malicious actors involves infecting corporate networks with ransomware to extract millions of dollars in profits. Ransomware falls into the category of malware. It works by encrypting sensitive data and demanding payments from victims to receive the encryption keys necessary for decrypting their data. The prevalence of this type of attack has prompted governments and organisations worldwide to intensify their efforts to combat ransomware. In response, the research community has also focused on ransomware detection, leveraging technologies such as machine learning. Despite this increased attention, practical solutions for real-world applications remain scarce in the existing literature. Numerous surveys have explored literature within the domain. Still, there is a notable lack of emphasis on the design of ransomware detection systems and the practical aspects of detection, including real-time and early detection. Against this backdrop, our review delves into the existing literature on ransomware detection, specifically examining the machine-learning techniques, detection approaches, and designs employed. Finally, we highlight the limitations of prior studies and propose future research directions in this crucial area.

show abstract

A New Scheme for Ransomware Classification and Clustering Using Static Features

et al. 2022

View full text Add to dashboard Cite

Ransomware is a strain of malware that disables access to the user’s resources after infiltrating a victim’s system. Ransomware is one of the most dangerous malware organizations face by blocking data access or publishing private data over the internet. The major challenge of any entity is how to decrypt the files encrypted by ransomware. Ransomware’s binary analysis can provide a means to characterize the relationships between different features used by ransomware families to track the ransomware encryption mechanism routine. In this paper, we compare the different ransomware detection approaches and techniques. We investigate the criteria, parameters, and tools used in the ransomware detection ecosystem. We present the main recommendations and best practices for ransomware mitigation. In addition, we propose an efficient ransomware indexing system that provides search functionalities, similarity checking, sample classification, and clustering. The new system scheme mainly targets native ransomware binaries, and the indexing engine depends on hybrid data from the static analyzer system. Our scheme tracks and classifies ransomware based on static features to find the similarity between different ransomware samples. This is done by calculating the absolute Jaccard index. Results have shown that Import Address Table (IAT) feature can be used to classify different ransomware more accurately than the Strings feature.

show abstract

Machine Learning in Automated Detection of Ransomware: Scope, Benefits and Challenges

Cited by 3 publications

References 92 publications

LLaMa Assisted Reverse Engineering of Modern Ransomware: A Comparative Analysis with Early Crypto-Ransomware

LLaMa Assisted Reverse Engineering of Modern Ransomware: A Comparative Analysis with Early Crypto-Ransomware

Ransomware Detection Using Machine Learning: A Review, Research Limitations and Future Directions

A New Scheme for Ransomware Classification and Clustering Using Static Features

Contact Info

Product

Resources

About