RanSAP: An open dataset of ransomware storage access patterns for training machine learning models

Hirano, Manabu; Hodota, Ryo; Kobayashi, Ryota

doi:10.1016/j.fsidi.2021.301314

Cited by 33 publications

(21 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Similarly, for some other proposals e.g., [ 19 , 20 , 24 ], there is a huge difference among various statistics, which is convincing enough to claim that the security provision with the proposed approach is significantly different from these proposals. Similar trends can also be observed with other proposals i.e., [ 25 , 27 , 28 ].…”

Section: Experimental Resultssupporting

confidence: 90%

See 1 more Smart Citation

An Effective Self-Configurable Ransomware Prevention Technique for IoMT

Tariq

Ullah

Uddin

et al. 2022

Sensors

View full text Add to dashboard Cite

Remote healthcare systems and applications are being enabled via the Internet of Medical Things (IoMT), which is an automated system that facilitates the critical and emergency healthcare services in urban areas, in addition to, bridges the isolated rural communities for various healthcare services. Researchers and developers are, to date, considering the majority of the technological aspects and critical issues around the IoMT, e.g., security vulnerabilities and other cybercrimes. One of such major challenges IoMT has to face is widespread ransomware attacks; a malicious malware that encrypts the patients’ critical data, restricts access to IoMT devices or entirely disable IoMT devices, or uses several combinations to compromise the overall system functionality, mainly for ransom. These ransomware attacks would have several devastating consequences, such as loss of life-threatening data and system functionality, ceasing emergency and life-saving services, wastage of several vital resources etc. This paper presents a ransomware analysis and identification architecture with the objective to detect and validate the ransomware attacks and to evaluate its accuracy using a comprehensive verification process. We first develop a comprehensive experimental environment, to simulate a real-time IoMT network, for experimenting various types of ransomware attacks. Following, we construct a comprehensive set of ransomware attacks and analyze their effects over an IoMT network devices. Furthermore, we develop an effective detection filter for detecting various ransomware attacks (e.g., static and dynamic attacks) and evaluate the degree of damages caused to the IoMT network devices. In addition, we develop a defense system to block the ransomware attacks and notify the backend control system. To evaluate the effectiveness of the proposed framework, we experimented our architecture with 194 various samples of malware and 46 variants, with a duration of sixty minutes for each sample, and thoroughly examined the network traffic data for malicious behaviors. The evaluation results show more than 95% of accuracy of detecting various ransomware attacks.

show abstract

Section: Experimental Resultssupporting

confidence: 90%

“…Manabu et al [ 28 ] presented an open data set about hypervisor-based ransomware storage intake behaviors. The dataset contains entree configurations of ransomware options that considers variable OS versions and encryption applied methodologies as a benchmarking criterion for sample segmentation.…”

Section: Related Workmentioning

confidence: 99%

An Effective Self-Configurable Ransomware Prevention Technique for IoMT

Tariq

Ullah

Uddin

et al. 2022

Sensors

View full text Add to dashboard Cite

show abstract

“…Table 1 shows that only one study works in the Android operating system [ 3 ]; one is applied over a software defined network (SDN) [ 23 ], all the others analyze at least one Windows platform, and one also researches over the Linux server [ 24 , 25 ].…”

Section: Related Workmentioning

confidence: 99%

Dynamic Feature Dataset for Ransomware Detection Using Machine Learning Algorithms

Silva

Hernández-Álvarez

2023

Sensors

View full text Add to dashboard Cite

Ransomware-related cyber-attacks have been on the rise over the last decade, disturbing organizations considerably. Developing new and better ways to detect this type of malware is necessary. This research applies dynamic analysis and machine learning to identify the ever-evolving ransomware signatures using selected dynamic features. Since most of the attributes are shared by diverse ransomware-affected samples, our study can be used for detecting current and even new variants of the threat. This research has the following objectives: (1) Execute experiments with encryptor and locker ransomware combined with goodware to generate JSON files with dynamic parameters using a sandbox. (2) Analyze and select the most relevant and non-redundant dynamic features for identifying encryptor and locker ransomware from goodware. (3) Generate and make public a dynamic features dataset that includes these selected parameters for samples of different artifacts. (4) Apply the dynamic feature dataset to obtain models with machine learning algorithms. Five platforms, 20 ransomware, and 20 goodware artifacts were evaluated. The final feature dataset is composed of 2000 registers of 50 characteristics each. This dataset allows for a machine learning detection with a 10-fold cross-evaluation with an average accuracy superior to 0.99 for gradient boosted regression trees, random forest, and neural networks.

show abstract

“…The proposed system achieved the average F 1 score of 96.2% in detecting ransomware and 94.1% in detecting ransomware variants. Furthermore, Hirano et al released the open dataset of the low-level ransomware storage access patterns for researchers who are interested in constructing machine learning models for ransomware detection [7]. In this paper, we added a novel monitoring function of memory access patterns to the live-forensic hypervisor presented in the previous papers [5]- [7].…”

Section: Shinagawa Et Al Released An Open-source Lightweight Hypervis...mentioning

confidence: 99%

Machine Learning-based Ransomware Detection Using Low-level Memory Access Patterns Obtained From Live-forensic Hypervisor

Hirano,

Kobayashi

2022

Preprint

Self Cite

View full text Add to dashboard Cite

Since modern anti-virus software mainly depends on a signature-based static analysis, they are not suitable for coping with the rapid increase in malware variants. Moreover, even worse, many vulnerabilities of operating systems enable attackers to evade such protection mechanisms. We, therefore, developed a thin and lightweight live-forensic hypervisor to create an additional protection layer under a conventional protection layer of operating systems with supporting ransomware detection using dynamic behavioral features. The developed live-forensic hypervisor collects low-level memory access patterns instead of highlevel information such as process IDs and API calls that modern Virtual Machine Introspection techniques have employed. We then created the low-level memory access patterns dataset of three ransomware samples, one wiper malware sample, and four benign applications. We confirmed that our best machine learning classifier using only low-level memory access patterns achieved an F1 score of 0.95 in detecting ransomware and wiper malware.

show abstract

RanSAP: An open dataset of ransomware storage access patterns for training machine learning models

Cited by 33 publications

References 29 publications

An Effective Self-Configurable Ransomware Prevention Technique for IoMT

An Effective Self-Configurable Ransomware Prevention Technique for IoMT

Dynamic Feature Dataset for Ransomware Detection Using Machine Learning Algorithms

Machine Learning-based Ransomware Detection Using Low-level Memory Access Patterns Obtained From Live-forensic Hypervisor

Contact Info

Product

Resources

About