Source-linked AI summary
Know Abnormal, Find Evil: Frequent Pattern Mining for Ransomware Threat Hunting and Intelligence
Sajad Homayoun, Ali Dehghantanha, Marzieh Ahmadzadeh, Sattar Hashemi, Raouf Khayami
TL;DR
Crypto-ransomware requires timely analysis of activity logs to detect malicious behavior and distinguish ransomware families. The paper mines sequential patterns from controlled logs of ransomware and benign applications, then evaluates the resulting features with four classifiers. It reports 99% accuracy for ransomware detection and 96.5% accuracy for family detection, with the patterns also supporting threat intelligence about ransomware families.
Problem
Crypto-ransomware removes access to valuable data through encryption, making timely and accurate log-based detection important for stopping attacks.
Method
The study collects runtime activity logs from ransomware and benign applications, mines sequential patterns, and evaluates selected features with J48, Random Forest, Bagging, and MLP classifiers.
Results
99% accuracy was achieved for detecting ransomware from goodware, while family detection reached 96.5% accuracy.
Takeaways & Limitations
Distinctive frequent patterns can support ransomware hunting and identification of ransomware families for building threat-actor and target threat-profile intelligence.
Abstract
from arXiv · showhide
Emergence of crypto-ransomware has significantly changed the cyber threat landscape. A crypto ransomware removes data custodian access by encrypting valuable data on victims' computers and requests a ransom payment to reinstantiate custodian access by decrypting data. Timely detection of ransomware very much depends on how quickly and accurately system logs can be mined to hunt abnormalities and stop the evil. In this paper we first setup an environment to collect activity logs of 517 Locky ransomware samples, 535 Cerber ransomware samples and 572 samples of TeslaCrypt ransomware. We utilize Sequential Pattern Mining to find Maximal Frequent Patterns (MFP) of activities within different ransomware families as candidate features for classification using J48, Random Forest, Bagging and MLP algorithms. We could achieve 99% accuracy in detecting ransomware instances from goodware samples and 96.5% accuracy in detecting family of a given ransomware sample. Our results indicate usefulness and practicality of applying pattern mining techniques in detection of good features for ransomware hunting. Moreover, we showed existence of distinctive frequent patterns within different ransomware families which can be used for identification of a ransomware sample family for building intelligence about threat actors and threat profile of a given target.
I. INTRODUCTION
The paper frames crypto-ransomware as a growing threat and proposes sequential pattern mining to identify features for ransomware detection and family classification. It evaluates these features with multiple classifiers and reports strong detection performance using activity logs.
- Threat and scope: Crypto-ransomware encrypts selected or all victim data and demands payment for possible recovery, unlike locker ransomware, which denies system access without changing stored data.The paper focuses exclusively on crypto-ransomware.
- Threat and scope: 267% annual growth in 2016 illustrates the expanding ransomware threat that motivates automated detection.The paper notes that ransomware attacks target industries ranging from healthcare to banking and power grids.
- Approach and contribution: Sequential pattern mining identifies features for distinguishing ransomware from benign applications and identifying ransomware families.The approach uses J48, Random Forest, Bagging, and MLP classifiers.
- Approach and contribution: 99% accuracy was achieved for ransomware detection, while family detection reached 96.5% accuracy.The study used logs from 517 Locky, 535 Cerber, and 572 TeslaCrypt samples, alongside 220 benign applications.
- Evaluation: The evaluation uses true-positive, false-positive, true-negative, and false-negative criteria, with precision, recall, F-measure, ROC/AUC, and MCC used to assess classifiers.MCC is included to assess performance against imbalanced datasets and distinguish classifiers from random prediction.
- Paper organization: The paper is organized around related work, controlled data collection and preprocessing, feature extraction and vectorization, ransomware detection, family detection, and conclusions.The stated workflow moves from data preparation to feature construction and two classification tasks.
II. RELATED WORK
Prior ransomware defenses commonly rely on filesystem and registry events, while earlier work also used event associations for rapid detection. The paper positions timely detection and family identification as complementary requirements for threat response and intelligence.
- Preventive measures: Preventive work includes ransomware-focused education, simulated attacks, application trust checks, and limiting end-user privileges.These measures are described as useful or effective in reducing infections or preventing attacks.
- Existing detection approaches: Most ransomware detection solutions rely on filesystem and registry events to identify malicious behavior.A study of 1,359 samples found that many ransomware programs use similar APIs and generate similar filesystem logs.
- Existing detection approaches: EldeRan detected ransomware within 30 seconds using associations among operating-system events, achieving an AUC of 0.995.The cited approach built a matrix of application activities from event associations.
- Timeliness and intelligence: Detection within 10 seconds is presented as necessary for an effective ransomware defense.The paper contrasts this requirement with the 30-second detection time reported for earlier work.
- Timeliness and intelligence: Identifying a ransomware family can support intelligence about applicable threat actors and the threat profile of a target.The passage presents family identification as a distinct value beyond detecting ransomware itself.
III. DATA CREATION
The study builds ransomware and benign-application datasets by collecting runtime event logs in an automated virtualized environment, converting each application’s activity into time-ordered event sequences, and removing outlier sequences.
- The dataset contains 517 Locky, 535 Cerber, 572 TeslaCrypt, and 220 benign Windows PE32 applications.
- The environment executes each sample in a virtual machine and collects the first 10 seconds of runtime activity logs.A controller transfers samples, launches monitoring, stores logs, and reverts the VM before the next sample.
- Events are categorized into Registry, Filesystem, or DLL types before sequence construction.
- Each application is represented as a time-ordered sequence of runtime events for sequential pattern mining.Events include activity types and their arguments, such as file reads or DLL loads.
- FindFPOF removes outlier sequences separately for each ransomware family by identifying sequences containing the least frequent patterns.
IV. FEATURE EXTRACTION AND VECTORIZATION
The feature pipeline mines maximal sequential patterns from application-event sequences, restricts pattern types to reduce sparsity, and converts each sequence into support-ratio vectors for classification.
- The maximal pattern collection contains patterns meeting minimum support that are not contained in any larger sequential pattern.
- MG-FSM extracts maximal sequential patterns from long event sequences using a scalable frequent-pattern-growth approach.The paper selects MG-FSM because sequences contain more than 5000 elements and traditional algorithms can be inefficient.
- A 50% minimum-support threshold balances computational feasibility against retaining useful maximal sequential patterns.
- The study distinguishes three atomic pattern types and six single-step transition types, such as Registry-to-DLL transitions.Atomic patterns contain events of one type, while transition patterns move between atomic event types.
- Each sequence becomes a nine-dimensional vector containing the support ratio for every detected maximal sequential-pattern type.Support ratio is computed from pattern frequency relative to the ransomware sequences in the dataset.
- SuperVectors combine vectors generated from maximal-pattern collections derived from different datasets.
V. HUNTING FOR EVIL: RANSOMWARE DETECTION
Sequential pattern mining selected Registry, DLL, and Filesystem-to-DLL activity features for ransomware detection, which performed strongly across multiple classifiers and unseen samples.
- Feature selection: Registry (R), DLL (D), and Filesystem-to-DLL (FD) activity types were selected as distinguishing features between ransomware and goodware.These features were identified using greedy stepwise search with CfsSubsetEval.
- Classifier performance: 0.99 F-measure was achieved by all four classifiers, with false-positive rates of at most 0.04.The evaluated classifiers were J48, Random Forest, Bagging, and MLP.
- Classifier performance: 0.995 AUC was achieved by Bagging, while all classifiers exceeded 0.990 AUC.The classifiers’ ROC curves were similar, indicating little performance difference among them.
- Classifier performance: More than 0.96 MCC was obtained for all classifiers, with Random Forest and Bagging approaching perfect prediction.Bagging and Random Forest achieved MCC values close to +1.
- Unseen-sample evaluation: 0.994 accuracy was achieved on unforeseen ransomware and goodware samples.The authors used this evaluation to assess whether the classifiers had overfit their training data.
VI. THREAT INTELLIGENCE: DETECTION OF A RANSOMWARE FAMILY
The study used 13 selected activity features to classify Locky, Cerber, TeslaCrypt, and goodware, achieving strong performance on both cross-validation and unforeseen samples.
- Feature selection: 13 candidate features were selected for classifying ransomware families from Locky, Cerber, TeslaCrypt, and goodware activity sequences.Atomic Registry activities, SRR, and Filesystem-to-DLL transitions were among the features identified as important for family differentiation.
- Feature interpretation: Atomic Registry activities, SRR, and Filesystem-to-DLL transitions were identified as useful features for separating ransomware families.Locky showed more Registry activity, Cerber more DLL activity, and Cerber the most common Filesystem-to-Registry transitions among the reported comparisons.
- Classifier performance: 0.983 minimum weighted-average F-measure was obtained with false-positive rates of at most 0.006.The four classifiers were evaluated using 10-fold cross-validation.
- Unseen-sample evaluation: At least 0.965 accuracy was obtained on unforeseen ransomware-family samples.All classifiers also achieved MCC values above 0.95 in the reported family-classification evaluation.
VII. CONCLUDING REMARKS
The paper combines sequential pattern mining with machine-learning classifiers to detect ransomware and identify its family within the first 10 seconds of execution, while outlining practical uses and future extensions.
- Conclusions: Sequential pattern mining combined with machine-learning classification distinguished ransomware from goodware and identified ransomware families within the first 10 seconds of execution.The approach uses frequent activity features extracted from ransomware logs.
- Conclusions: 0.994 minimum F-measure and 0.99 minimum AUC were achieved for detecting ransomware from goodware.The reported features included Registry events, DLL events, and Filesystem-to-Registry transitions.
- Conclusions: More than 0.98 F-measure with less than 0.007 FPR was achieved for ransomware-family detection using 13 selected features.The reported dataset contains 1,624 ransomware samples and 220 benign applications.
- Implications: The reported features may support ransomware threat hunting and construction of threat profiles for a given target.The paper also presents the dataset as a resource for future ransomware-behavior research.
- Future work: Future work includes fuzzy classification, stream data mining, and applying the technique to mobile malware and IoT forensics.The authors also propose extending forensic-by-design to ransomware detection, mitigation, and rollback.