Towards Runtime Classification of Ransomware

Abstract

The availability of computer systems is constantly being challenged by cybercriminals who seek to disrupt access to this indispensable technology and the data they contain as a means for making profit. This trend has given rise to a new form of malware that is known as ransomware, an invasive type of malware that is designed to appropriate compute resources in return for a ransom. According to the U.S. Department of Homeland Security, ransomware represents the fastest growing malware threat to individuals and organizations. With the cost of ransomware attacks projected to exceed $20 billion in the year 2021, it is imperative to explore solutions that can defend against such malware. In this study, we evaluate the effectiveness of machine learning algorithms and their suitability for detecting ransomware on x86 platforms. We show that dynamically extracting instruction op- codes from execution traces can be harnessed for training machine learning models that can used to perform runtime detection of ransomware. We evaluate different machine learning models and demonstrate that tracking a limited number of instruction opcodes commonly used crypto- graphic are sufficient for reliably detecting ransomware with high accuracy. We show that our method can achieve high detection rates above 99% while evaluating our solution against real ransomware available in a state-of-the-art dataset from VirusTotal.