Source-linked AI summary
Automated Dynamic Analysis of Ransomware: Benefits, Limitations and use for Detection
Daniele Sgandurra, Luis Muñoz-González, Rabih Mohsen, Emil C. Lupu
TL;DR
Ransomware’s rapid evolution and sophisticated packing make detection difficult for signature-based and static-analysis approaches. EldeRan dynamically selects behavioral features and classifies applications with machine learning, achieving strong early-detection performance while retaining limitations against delayed, evasive, or isolated samples.
Problem
Ransomware evolves rapidly and sophisticated samples can evade signature-based antivirus, while packing makes static analysis difficult.
Method
EldeRan selects relevant binary dynamic features using Mutual Information and classifies newly installed applications with machine learning.
Results
96.3% detection rate was achieved, with approximately 400 selected features sufficient from an initial set of around 31,000.
Takeaways & Limitations
Dynamic analysis can detect ransomware during early installation phases and support detection of new ransomware families and variants.
Takeaways & Limitations
EldeRan may fail to extract features from ransomware that remains silent, waits for user actions, or uses anti-sandbox techniques; its evaluation VM also excluded other running applications.
Abstract
from arXiv · showhide
Recent statistics show that in 2015 more than 140 millions new malware samples have been found. Among these, a large portion is due to ransomware, the class of malware whose specific goal is to render the victim's system unusable, in particular by encrypting important files, and then ask the user to pay a ransom to revert the damage. Several ransomware include sophisticated packing techniques, and are hence difficult to statically analyse. We present EldeRan, a machine learning approach for dynamically analysing and classifying ransomware. EldeRan monitors a set of actions performed by applications in their first phases of installation checking for characteristics signs of ransomware. Our tests over a dataset of 582 ransomware belonging to 11 families, and with 942 goodware applications, show that EldeRan achieves an area under the ROC curve of 0.995. Furthermore, EldeRan works without requiring that an entire ransomware family is available beforehand. These results suggest that dynamic analysis can support ransomware detection, since ransomware samples exhibit a set of characteristic features at run-time that are common across families, and that helps the early detection of new variants. We also outline some limitations of dynamic analysis for ransomware and propose possible solutions.
1. INTRODUCTION
Ransomware increasingly threatens access to systems and data, while sophisticated packing makes static analysis difficult. EldeRan uses early runtime behavior and machine learning to detect ransomware, including previously unseen families.
- Ransomware locks computers or encrypts personal files, then demands payment to restore access.
- CryptoWall version 3 caused an estimated $325 million in US damages, illustrating the financial impact of ransomware extortion.
- EldeRan selects characteristic early dynamic features and classifies newly installed applications with machine learning rather than relying on signatures or classical heuristics.
- Mutual Information identifies a relatively small feature set without reducing classifier performance, supporting detection of new ransomware families.
- 2.4% average error rate versus 5.6% for VirusTotal, while EldeRan achieved a 96.3% detection rate and a 93.3% average rate for new families.
2. RANSOMWARE
Ransomware comprises locker and crypto variants that deny access to systems or files in exchange for payment. Its distribution includes phishing, exploit kits, downloaders, social engineering, and traffic distribution systems, while crypto-ransomware is especially difficult to recover from.
- Locker-ransomware blocks computer use, whereas crypto-ransomware encrypts personal files and makes them inaccessible.
- Ransom payments commonly use Bitcoin because its properties make transactions difficult to trace, while Tor can hide attacker infrastructure.
- Phishing or spam emails distribute ransomware through malicious links or attachments that download or drop the ransomware sample.
- Exploit kits use malicious advertisements and browser vulnerabilities to enable drive-by downloads of ransomware.
- Other distribution routes include downloaders and Trojan botnets, fake antivirus social engineering, and traffic distribution systems.
- Crypto-ransomware data recovery is usually more difficult than locker-ransomware system recovery.
3. EldeRan: CLASSIFICATION OF RANSOMWARE
EldeRan dynamically analyzes ransomware and goodware in a sandbox, selects discriminative behavioral features, and classifies applications with regularized logistic regression.
- EldeRan dynamically analyzes ransomware and goodware traces in a sandbox before classification.The system derives behavioral features from early application actions.
- Regularized Logistic Regression: Regularized Logistic Regression performs the final ransomware classification after feature selection.The classifier models class posterior probabilities through linear functions of the features.
- Feature Selection: Mutual Information selects the most discriminating binary features, reducing feature count while supporting simpler and potentially less overfit models.For binary presence or absence features, Mutual Information quantifies how much discrimination each feature adds.
- Regularized Logistic Regression: L2 regularization and Mutual Information feature selection provide two mechanisms to prevent overfitting.The regularization parameter λ is typically set by cross-validation.
- Regularized Logistic Regression: Regularized Logistic Regression is easier to train and adapt than SVM while remaining competitive with it in practical situations.Its parameters can be adapted online as new training samples arrive without retraining from scratch.
4. ANALYSIS OF THE FEATURES
The analysis uses sandbox-generated execution traces from ransomware and goodware to construct feature matrices, then examines feature relevance for detection. The dataset includes 582 ransomware samples from 11 classes and 942 benign applications, with Registry Keys and API Stats identified as especially relevant feature sets.
- Dynamic analysis: Cuckoo Sandbox was used to analyze malware execution and generate dynamic traces for feature processing.The parser retrieves JSON reports and converts them into matrices for feature selection and classification.
- Dataset: 582 ransomware samples from 11 classes and 942 goodware applications formed the analyzed dataset.Samples were collected from VirusShare and a software aggregator, respectively.
- Execution setting: The experiments used an isolated Windows XP 32-bit SP2 virtual machine with no concurrently running user applications.The weaker security protections were selected to expose more ransomware behavior during execution.
- Feature construction: The feature parser represents file operations using filename paths and operation presence, while also encoding file extensions, directory operations, and dropped-file types.Dropped-file features include types such as PE32, DOS batch, and JPEG.
- Feature relevance: Registry Keys and API Stats were the two most relevant feature sets, although the remaining sets also contributed useful information.The analysis links ransomware behavior to file activity, persistence-related registry access, process manipulation, and ransom-note files.
5. EXPERIMENTS
EldeRan is evaluated against machine-learning classifiers, VirusTotal, and leading antivirus vendors across repeated train/test splits. Results show strong performance with compact feature sets and promising detection of ransomware families excluded from training.
- 5.1 Comparison with other Classifiers: 100 train/test splits compare EldeRan, SVM, and Naive Bayes using AUC across feature-set sizes.The first experiment varies the selected features from 50 to 1,500, using 80% of samples for training and 20% for testing.
- 5.1 Comparison with other Classifiers: EldeRan and SVM outperform Naive Bayes, while EldeRan slightly outperforms SVM without a significant difference.EldeRan’s regularized logistic regression also supports online retraining more readily than SVM.
- 5.1 Comparison with other Classifiers: 400 features maximize performance for all three classifiers, despite the dataset containing 30,967 total features.Adding features beyond 400 does not improve accuracy, so the remaining experiments use the 400 highest-Mutual-Information features.
- 5.2 Comparison with VirusTotal: 2.4% average error and 96.3% detection rate make EldeRan stronger than VirusTotal on error and detection rate, although VirusTotal slightly leads in AUC.VirusTotal’s average error is 5.6%, while EldeRan’s false-positive rate is 1.6%.
- 5.2 Comparison with VirusTotal: EldeRan outperforms four of the top-five antivirus vendors in detection rate and ranks second overall, but the comparison is not fully fair.Machine-learning test samples are unseen by the classifier, whereas antivirus vendors may already possess signatures for those samples.
- 5.3 Detection of New Ransomware Families: 93.3% average detection with 100 features exceeds 87.1% with 400 features when testing ransomware families excluded from training.Using 100 features detects more than 90% of eight families and more than 80% of ten of eleven families; the authors attribute the difference to train/test distribution differences.
6. DISCUSSION
EldeRan shows that early dynamic behavior can detect ransomware, including unseen families, while dynamic analysis remains vulnerable to delayed execution and sandbox evasion. The discussion also identifies feature reduction and behavioral safeguards as important practical considerations.
- Benefits of Dynamic Analysis: 96.3% detection rate was achieved by EldeRan, including detection from ransomware’s early installation phases and when new families appear.The initial feature set of around 31,000 was reduced to 400 sufficient features.
- Benefits of Dynamic Analysis: Mutual Information identified relevant features effectively, with registry-key and API-call features particularly prominent.Feature selection reduced complexity without reducing the classifier’s performance.
- Benefits of Dynamic Analysis: Dynamic analysis supports early containment because ransomware can be tested briefly before infection and sophisticated packing undermines static analysis.Some ransomware delay payload release until environmental or command-and-control checks succeed.
- Limitations of Dynamic Analysis: EldeRan may fail to extract useful features from ransomware that remains silent, waits for user actions, or detects sandboxing and virtualization.Injecting real or scripted user actions is proposed as one mitigation.
- Limitations of Dynamic Analysis: The evaluation environment contained no applications beyond a fresh Windows installation, which ransomware could potentially use to detect analysis.The authors also suggest shorter analysis times, system-call patterns, and distinguishing legitimate encryption software from crypto-ransomware.
7. RELATED WORK
Related work covers ransomware history, economics, cryptographic attacks, and general malware-behavior analysis. EldeRan distinguishes itself through feature selection for efficient ransomware classification and reports results consistent with behavior-based detection findings.
- Ransomware and Malware Research: Prior work described crypto-virus prototypes, ransomware-family analyses, cryptographic extortion attacks, and the evolution of ransomware’s capabilities.The literature also includes reports on ransomware’s underground market.
- Behavioral Malware Analysis: General malware research proposed machine-learning methods to learn, discriminate, and automatically identify malware behaviors and novel behavioral classes.These approaches provide broader context for EldeRan’s ransomware-specific classification task.
- EldeRan’s Distinction: EldeRan differs from cited approaches by using feature selection to reduce machine-learning complexity without affecting performance.The authors contrast this with solutions that do not propose a feature-selection algorithm.
- Comparison with Ransomware Analysis: Analysis of 15 ransomware families found mostly naïve locking or encrypting techniques, while EldeRan detected more than 96% using limited features.The authors present this as confirmation of behavior-based detection findings.
8. CONCLUSION
The conclusion presents machine learning as a viable complement to antivirus defenses against evolving ransomware variants and families. It highlights automatic feature selection and regularized logistic regression as accurate, efficient components.
- Conclusion: Machine learning is presented as a viable and effective approach for detecting new ransomware variants and families for later analysis and signature extraction.The approach is positioned as a complement to antivirus systems.
- Conclusion: Mutual Information effectively selects features automatically, while Regularized Logistic Regression is accurate, fast, and easy to train and update.The classifier compares well with more sophisticated algorithms and outperforms more naïve approaches.