Critical Analysis of Ransomware in Relation to Cybercrime (PDF)

Academic Paper from the year 2023 in the subject Computer Science - IT-Security, grade: A, , language: English, abstract: Ransomware attacks are not a new idea, but their prevalence has risen dramatically in recent times. A key explanation for this is the financial compensation that the perpetrator stands to gain, as well as the fact that crypto-currency allows for anonymous transactions. Initially a single-host menace, ransomware is rapidly developing to conduct more sophisticated attacks by spreading through a network of hosts. One of the most difficult aspects of defending from these attacks is that every ransomware caucus is always evolving, rendering individual samples unidentifiable. Common signature-based countermeasures, such as those used to fight viruses, are made ineffective as a result. Furthermore, attempting to reverse engineer each sample in order to develop successful countermeasures or solutions is an expensive venture. Much more so now that ransomware writers are beginning to use complicated methods ensuring that getting to the original source code more difficult.

The researcher believes that a more general detection approach can be used to find a solution. It should be focused on the traits that all ransomware families share. This should help to shift the focus of research from samples to families. I collect meta-data about the files that are read and written during ransomware attacks using easy and fast metrics and applied a qualitative mode of data collection. These attacks have a common pattern of attempting to encrypt all of the victims' data. Encrypted files have a significant increase in entropy while the data size remains relatively unchanged. These characteristics can also be seen in normal user behaviour, such as when a user encrypts a file. As a result, we must allow encryption while also imposing a frequency limit to ensure that regular user traffic does not result in false positives.