PaperlayerView exact revision on arXiv

Source-linked AI summary

A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutions

Harun Oz, Ahmet Aris, Albert Levi, A. Selcuk Uluagac

arXiv:2102.06249v2cs.CR

TL;DR

Ransomware research lacked a comprehensive account spanning its evolution, characteristics, attack phases, and defenses across PCs/workstations, mobile devices, and IoT/CPS platforms. This paper surveys ransomware and defense research across those platforms, synthesizing evolution, ransomware building blocks, families, defenses, and open problems.

  • Problem

    Existing surveys covered selected ransomware aspects, but no study addressed evolution, characteristics, attack phases, and defense research across PCs/workstations, mobile devices, and IoT/CPS platforms.

  • Method

    The paper provides a comprehensive survey of ransomware evolution, building blocks, notable families, and analysis, detection, and recovery defenses across three platform categories.

  • Results

    The survey presents an extensive overview of ransomware defense research and derives open research problems for future ransomware research and practice.

  • Takeaways & Limitations

    Ransomware defense must account for platform diversity and evolving threats, including evasive encryption behavior and vulnerabilities in machine-learning-based classifiers.

  • Takeaways & Limitations

    IoT/CPS ransomware defense research remains sparse, and existing studies in this area use only behavioral features, specifically network activities.

Abstract

from arXiv · show

In recent years, ransomware has been one of the most notorious malware targeting end users, governments, and business organizations. It has become a very profitable business for cybercriminals with revenues of millions of dollars, and a very serious threat to organizations with financial loss of billions of dollars. Numerous studies were proposed to address the ransomware threat, including surveys that cover certain aspects of ransomware research. However, no study exists in the literature that gives the complete picture on ransomware and ransomware defense research with respect to the diversity of targeted platforms. Since ransomware is already prevalent in PCs/workstations/desktops/laptops, is becoming more prevalent in mobile devices, and has already hit IoT/CPS recently, and will likely grow further in the IoT/CPS domain very soon, understanding ransomware and analyzing defense mechanisms with respect to target platforms is becoming more imperative. In order to fill this gap and motivate further research, in this paper, we present a comprehensive survey on ransomware and ransomware defense research with respect to PCs/workstations, mobile devices, and IoT/CPS platforms. Specifically, covering 137 studies over the period of 1990-2020, we give a detailed overview of ransomware evolution, comprehensively analyze the key building blocks of ransomware, present a taxonomy of notable ransomware families, and provide an extensive overview of ransomware defense research (i.e., analysis, detection, and recovery) with respect to platforms of PCs/workstations, mobile devices, and IoT/CPS. Moreover, we derive an extensive list of open issues for future ransomware research. We believe this survey will motivate further research by giving a complete picture on state-of-the-art ransomware research.

1 Introduction

Ransomware has become a major and increasingly costly threat across end users, governments, and organizations. This survey addresses a literature gap by examining ransomware and defenses across PCs/workstations, mobile devices, and IoT/CPS platforms.

  • Threat context: Ransomware incidents increasingly affect end users, governments, and organizations across sectors.Reported targets include Fortune 500 companies, banks, cloud providers, hospitals, schools, universities, and police departments.
  • Threat context: $20 billion in organizational losses were predicted for 2021, with a new organization reportedly attacked every 11 seconds.A ransomware attack causing the first reported loss of human life occurred in Germany in 2020.
  • Ransomware background: Ransomware restricts access to systems or data until attackers’ ransom demands are satisfied, using cryptographic or locker methods.Cryptographic ransomware encrypts files, whereas locker ransomware blocks access to systems.
  • Research gap: Existing surveys address selected ransomware topics, but none provides a complete, platform-focused view of evolution, characteristics, attack phases, and defenses.The survey focuses on PCs/workstations, mobile devices, and IoT/CPS because ransomware prevalence differs across these platforms.
  • Survey scope: The survey covers ransomware evolution, building blocks, family taxonomy, platform-specific analysis, detection, recovery, and open research problems.Its contributions include an overview of research spanning PCs/workstations, mobile devices, and IoT/CPS platforms.

2 RELATED WORK

Prior ransomware surveys examine selected platforms, techniques, families, and defenses rather than the full cross-platform research landscape. The literature includes work on PCs/workstations, mobile devices, and machine-learning-based defenses.

  • PCs/workstations: Earlier surveys summarized PC ransomware trends, mitigation strategies, ransomware strains, infection methods, prevention, and Windows defenses.Other studies specifically reviewed machine-learning, deep-learning, and broader ransomware defense solutions.
  • Mobile devices: Mobile ransomware surveys reviewed Android evolution and behavior, Android analysis techniques, and Android detection techniques.The reviewed mobile literature therefore covered distinct aspects of ransomware research rather than a unified cross-platform treatment.

3 RANSOMWARE AND EVOLUTION OF RANSOMWARE

Ransomware evolved from early, limited attacks into a technically advanced and platform-expanding threat. Its major forms include cryptographic and locker ransomware, organized around generalized attack phases.

  • Ransomware types: Cryptographic ransomware encrypts, deletes, or overwrites victim files, while locker ransomware blocks system access without encrypting user data.Both types demand payment to restore files or access.
  • Attack phases: Ransomware attack models generally include infection, communication with command-and-control servers, and subsequent malicious actions.The survey presents a generalized model built on prior studies, although some families may omit individual phases.
  • Early evolution: 1989 marked the emergence of ransomware, followed by cryptovirology research and renewed digital extortion as Internet connectivity expanded around 2005.The first ransomware, AIDS Trojan, encrypted file names and demanded payment; later families adopted stronger cryptographic approaches.
  • Cryptographic development: 2005–2006 ransomware families adopted asymmetric encryption, making recovery nearly impossible without attackers’ decryption keys.CryZip, Archiveus, and Krotten were among the earliest families identified as using asymmetric encryption.
  • Platform expansion: 2014–2015 ransomware expanded to mobile devices and new operating systems, including Android, macOS, and GNU/Linux platforms.Early mobile examples included locker and cryptographic ransomware, while Linux.Encoder and KeRanger used hybrid encryption.
  • Ransomware-as-a-Service: 2015 introduced ransomware-as-a-service, enabling user-friendly, modifiable kits that could be repackaged across platforms and contributing to more attacks.The model marked a shift toward platform-agnostic ransomware distribution.
  • Contemporary threat: By 2020, ransomware had developed stronger encryption, diverse infection vectors, pseudo-anonymous payments, and broader targets, making recovery without ransom payment or backups nearly impossible.The survey describes this progression as affecting users, organizations, enterprises, and critical infrastructures.

4 TAXONOMY OF RANSOMWARE

The survey classifies ransomware by target, infection method, command-and-control communication, and malicious action. Its target taxonomy distinguishes victim types from target platforms.

  • Taxonomy framework: Ransomware targets are classified along two orthogonal dimensions: target victim and target platform.This structure separates who is attacked from the computing environment being targeted.
  • Target victims: Victims comprise end users and organizations, whose security conditions, operational importance, and ransom incentives differ.Organizations may be selected in advance to maximize disruption and encourage larger ransom payments.
  • Target platforms: PCs/workstations are the most common ransomware targets, especially Windows systems, although macOS and GNU/Linux families also exist.Screen-locker attacks may be mitigated by reinstalling the operating system, whereas cryptographic attacks are more difficult to reverse.
  • Target platforms: Mobile ransomware primarily affects Android and iOS ecosystems, with Android presenting the more serious threat because of its open application ecosystem.The first mobile locker and cryptographic ransomware examples targeted Android; iOS examples were fake ransomware.
  • Target platforms: IoT/CPS devices are not currently major ransomware targets, but their use in smart homes, health, buildings, transportation, cities, and factories creates expanding exposure.Industrial devices such as PLCs, RTUs, and RIOs already support industrial control systems.

4.2 Classification by Infection Vectors

Ransomware uses traditional malware infection vectors, while its malicious actions include encryption, locking, destruction, and increasingly information theft.

  • Infection vectors: Ransomware infection vectors comprise malicious e-mails, SMS or instant messages, malicious applications, drive-by downloads, and vulnerabilities.
  • Mobile vectors: SMS or instant messages frequently deliver mobile ransomware by directing victims to malicious websites that download the malware.
  • Malicious actions: Ransomware can encrypt victim files or lock system components through screen, browser, or Master Boot Record locking.
  • Malicious actions: Some recent ransomware families steal valuable information and may demand separate payments for decryption and preventing publication.

4.5 Classification by Extortion Method

Ransomware extortion methods have evolved around anonymity, progressing from premium-rate messages and prepaid vouchers toward cryptocurrencies.

  • Extortion methods: Ransomware’s main objective is extorting ransom payments, and anonymity is the fundamental characteristic of its extortion methods.
  • Extortion methods: Cybercriminals have used premium-rate text messages and prepaid vouchers such as Paysafe cards to collect ransom payments.
  • Extortion methods: Cryptocurrencies such as Bitcoin are currently the most preferred extortion method.

4.6 Taxonomy of Notable Ransomware Families

The survey’s taxonomy covers notable ransomware families from 1989 to 2020 and compares their infection, communication, platform, encryption, destruction, and payment characteristics.

  • Taxonomy: Table 2 summarizes notable ransomware families observed in the wild between 1989 and 2020, using attack instances, academic papers, and security-company sources.
  • Infection methods: 33% of notable ransomware families use phishing, while exploit kits, drive-by downloads, and malicious applications are other popular infection methods.
  • C&C communication: More than 50% of families use hardcoded IP addresses or domains, while almost one third employ no C&C communication.
  • Target platforms: Windows is the most popular target platform, followed by OS-agnostic and Android-based ransomware.
  • Ransomware type: Most notable families are cryptographic, although locker ransomware was more dominant during 2009–2013 and remains a crucial Android threat.
  • Encryption techniques: Symmetric-key encryption is more popular than asymmetric or hybrid encryption, while only 20% of families solely use asymmetric encryption.
  • Destruction methods: Almost two thirds of notable families delete original files after encryption, while one third overwrite them; deleting shadow copies is also common.
  • Extortion methods: Cryptographic families mostly use cryptocurrencies, mobile strains mostly use SMS payments, and enterprise-targeting strains use encrypted e-mail services for negotiation.

5 Ransomware Defense Research

The survey organizes ransomware defense research into analysis, detection, recovery, and other defense research, examined across PCs/workstations, mobile devices, and IoT/CPS platforms.

  • Defense research categories: Ransomware defense research is divided into four categories: analysis, detection, recovery, and other defense research.
  • Platform scope: The survey provides a taxonomy for each defense domain across PCs/workstations, mobile devices, and IoT/CPS platforms.
  • Survey organization: Its platform-oriented sequence reviews ransomware analysis techniques, detection systems, and recovery mechanisms.

5.1 Ransomware Analysis Research

Ransomware analysis research uses static, dynamic, and hybrid approaches to characterize samples across PCs/workstations, mobile devices, and IoT/CPS platforms. Static and dynamic analyses expose complementary structural and behavioral features, while IoT/CPS research remains limited and has used network activity as its only reported feature.

  • Analysis approaches: Static analysis extracts structural information without executing samples, making it generally fast and safe but vulnerable to obfuscation and related concealment techniques.Researchers disassemble binaries and inspect their structure or content.
  • Analysis approaches: Dynamic analysis executes ransomware in isolated environments and observes behavior, but anti-debugging, sandbox fingerprinting, and logic bombs complicate analysis.Hooking and sandbox functions can monitor sample behavior while limiting possible damage.
  • Analysis approaches: Hybrid analysis combines static and dynamic approaches because each has distinct advantages and disadvantages.The survey categorizes features extracted through both approaches in ransomware research.
  • PCs/workstations: PC/workstation research extracts structural features such as hashes, headers, calls, strings, opcodes, and file types, alongside behavioral features including registry, process, file-system, network, and resource activity.I/O access patterns involving repetitive read, write, and delete operations can support ransomware detection.
  • Mobile devices: Mobile ransomware analysis uses structural features such as strings, opcodes, images, permissions, and API packages, plus behavioral features including calls, user interaction, file-system activity, and resource usage.Extracted strings may include IP addresses, domains, and ransom notes, while runtime calls and user interactions can support detection.
  • IoT/CPS platforms: IoT/CPS ransomware defense research is still in its infancy, and existing studies have reported only behavioral network-activity features to identify communication patterns signifying ransomware.The survey attributes the limited feature coverage to the small number of existing studies.

5.2 Ransomware Detection Research

Ransomware detection research spans diverse methodologies and platforms, with machine learning predominant across PCs/workstations, mobile devices, and IoT/CPS. Reported detection rates are generally high, but dataset disclosure and evaluation breadth vary substantially.

  • Detection Methodologies: Detection systems are categorized into eight methodology groups, including blacklist-, rule-, statistics-, formal methods-, nature-inspired computing-, and information theory-based approaches.Information theory-based methods often use entropy changes caused by cryptographic ransomware, although benign encryption, compression, and file conversion can also affect entropy.
  • PCs/Workstations: 73% of PC/workstation studies used machine learning, while rule-based detection was the second-most common approach at 14%.Among machine-learning studies, 43% used behavioral features, 12% structural features, and 18% both.
  • Mobile Devices: Over 60% of mobile ransomware detection systems used machine learning, primarily with structural features obtained through static analysis.The paper relates this preference to mobile resource limitations that may constrain real-time behavioral analysis.
  • IoT/CPS: IoT/CPS ransomware detection studies used only machine learning, with reported TPRs from 91% to 99.47% and FPRs from 2% to 13.9%.Most IoT/CPS studies did not report data sources or the number of ransomware families used.
  • Cross-Platform Comparison: Across platforms, 72% of defense solutions used machine learning, while feature choices differed between resource-rich PCs/workstations and mobile devices.PC/workstation and IoT/CPS studies mainly relied on behavioral features, whereas mobile studies mostly used structural features; API-related features were widely used overall.
  • Cross-Platform Comparison: VirusTotal was the most widely used data source across platforms, while dataset reporting was less complete for mobile and IoT/CPS studies.76% of PC/workstation studies reported ransomware-family counts, compared with 36% of mobile studies; most mobile datasets were imbalanced.
  • Cross-Platform Comparison: Reported TPRs ranged from 73% to 100% and FPRs from 0% to 19%, but many perfect PC/workstation TPRs appeared over-optimistic.The authors state that broader datasets containing benign and malicious samples could make reported results more realistic.

5.3 Ransomware Recovery Research

Recovery research for PCs/workstations uses key recovery, hardware-based file recovery, and cloud backups, while only two studies address mobile-device recovery.

  • PC/workstation recovery mechanisms fall into key recovery, hardware-based file recovery, and cloud-backup file recovery.
  • PayBreak uses key escrow to capture encryption keys, while another system automates backups and reduces backup-space overhead.
  • CLDSafe stores shadow copies of files in a protected cloud safe zone for recovery.
  • Only two studies address ransomware recovery for mobile devices.
  • MimosaFTL analyzes ransomware access behavior and applies K-means clustering to identify distinctive access patterns in flash storage.

5.4 Other Ransomware Defense Research

Other ransomware defenses are grouped into moving-target, access-control, and holistic systems that combine monitoring, detection, and behavioral analysis.

  • Other defense studies are categorized as moving-target, access-control, or holistic defense mechanisms.
  • A moving-target defense randomly changes file extensions to protect against ransomware.
  • UShallNotPass blocks unauthorized applications from accessing operating-system pseudo-random number generator functions before encryption.
  • Key-SSD applies disk-level access control to SSD storage units to block unauthorized applications.
  • VoterChoice combines Suricata intrusion prevention, ML detection using encryption and registry features, and a client-based honeypot for behavioral analysis.

6 OPEN ISSUES

The survey identifies evolving ransomware tactics, expanding targets, organizational vulnerabilities, and limitations in current defenses as open research issues.

  • The Constant Evolution of Ransomware: Ransomware continues evolving across target platforms, infection methods, encryption, communication, destruction behavior, and payment methods.
  • Human-Operated Ransomware Attacks: Human-operated campaigns require defenders to combat knowledgeable attackers in real time rather than relying only on automated defenses.
  • Rootkit Fashion: Rootkit techniques can hide ransomware and delay execution, potentially reducing the accuracy of existing detection systems.
  • Ransomware Living of the Land: Fileless ransomware uses benign tools such as Powershell, leaves fewer system footprints, and makes detection difficult.
  • Changing Encryption Tradition: Throttled encryption can evade the low-level I/O patterns that distinguish aggressive ransomware encryption from benign activity.
  • More Exfiltration Attacks: Exfiltration attacks extend ransomware beyond encryption or system locking by threatening to publish stolen sensitive information.
  • Leveraging Internal Threats: Insiders can bypass well-protected systems by installing ransomware, disabling defenses, or reaching unprotected network segments.
  • New Ransomware Targets: IoT/CPS ransomware could threaten safety-critical services, including implantable or ambulatory medical devices.

7 Conclusion

The survey synthesizes ransomware evolution, families, and defense research across PCs/workstations, mobile devices, and IoT/CPS, while identifying open problems for future research and practice.

  • The paper surveys ransomware evolution, analyzes its building blocks, and presents a taxonomy of notable ransomware families.
  • It reviews ransomware analysis, detection, and recovery techniques across PCs/workstations, mobile devices, and IoT/CPS environments.
  • The survey derives open research problems for future ransomware research and practice.
Loading 2102.06249v2…