Open Repository for the Evaluation of Ransomware Detection Tools

Abstract

Crypto-ransomware is a type of malware that encrypts user files, deletes the original data, and asks for ransom to recover the hijacked documents. Several articles have presented detection techniques for this type of malware; these techniques are applied before the ransomware encrypts files or during its action in an infected host. The evaluation of these proposals has always been accomplished using sets of ransomware samples that are prepared locally for the research article, without making the data available. Different studies use different sets of samples and different evaluation metrics, resulting in insufficient comparability. In this paper, we describe a public data repository containing the file access operations of more than 70 ransomware samples during the encryption of a large network shared directory. These data have already been used successfully in the evaluation of a network-based ransomware detection algorithm. Now, we are making these data available to the community and describing their details, how they were captured, and how they can be used in the evaluation and comparison of the results of most ransomware detection techniques. INDEX TERMSRansomware, open repository, traffic analysis. EDUARDO BERRUETA was graduated in telecommunication engineering from the Public University of Navarre (UPNA), Spain, in 2016. He received the M.Sc. degree in telecommunication engineering from UPNA, in 2018, where he is currently pursuing the Ph.D. degree with the Telecommunications, Networks and Services Research Group. Previously, he attended the University of Turin for completing his thesis on software defined networking. In 2016, he held a Scholarship at the Automatics and Computing Department. In 2017 and 2018, he was a Research Assistant with the Telecommunications, Networks and Services Research Group, UPNA. DANIEL MORATO received the M.Sc. degree in telecommunication engineering and the Ph.D. degree from the Public University of Navarre, Spain. In 2002, he was a Visiting Postdoctoral Fellow with the Electrical Engineering and Computer Sciences Department, University of California at Berkeley, Berkeley. Since 2006, he has been working at the Public University of Navarre. He is currently an Associate Professor with the Department of Electrical, Electronic and Communications Engineering. In 2014, he became a member of the Institute of Smart Cities. His research interests include high-speed networks, the performance and traffic analysis of Internet services, and network monitoring. EDUARDO MAGAÑA received the M.Sc. and Ph.D. degrees in telecommunications engineering from the

Ransomware Detection using Process Memory

“…Over the years, significant advances have been made in ransomware detection, especially after the devastation that WannaCry caused in 2017 (Adamov & Carlsson, 2017;Berrueta, Morato, Magana, et al, 2020;Fernando, Komninos & Chen, 2020;Molina, Torabi, Sarieddine, et al, 2021;Singh et al, 2019a). Although researchers explored avenues for detection such as static and dynamic information, ransomware has managed to evade static analysis (Subedi et al, 2018).…”

Crypto-ransomware detection using machine learning models in file-sharing network scenarios with encrypted traffic

“…The traffic traces for the 'infected' case were obtained from a repository we built and shared publicly in (Berrueta et al, 2020;Berrueta et al, 2022). This repository comprises traffic traces from more than 70 ransomware programs.…”

“…There are variants that apply compression to the written data (CTBLocker), variants that batch the file deletion operations (WannaCry), variants that do only partial overwrites of the original files (Shade), or variants operating at low speeds (Revenge), to name a few relevant features. More detail about the binaries and the traffic traces can be found in Berrueta et al (2020) or Berrueta et al (2022); we offer statistics, downloadable traffic files, links to the malware binaries, and text files containing all the file-access operations executed.…”

“…Owing to the differences between the encryption processes of different ransomware binaries, the number of bytes encrypted can vary greatly among them. Some ransomware strains encrypt files in the alphabetic order, whereas others do it according to size (Berrueta et al, 2020); this is the reason for the differences in the number of bytes encrypted.…”

Inhibiting crypto‐ransomware on windows platforms through a honeyfile‐based approach with R‐Locker

“…For that, some public repositories of malware samples are available. One example of that is [51], but in this case just pcap files are available instead of malware samples themselves. Therefore, we have acquired the experimental samples from TheZoo repository [52].…”