[Paper Review] Automated Dynamic Analysis of Ransomware: Benefits, Limitations and use for Detection

Daniele Sgandurra, Luis Muñoz-González+2 more|arXiv (Cornell University)|Sep 10, 2016

Advanced Malware Detection Techniques159 citations

TL;DR

EldeRan uses dynamic sandbox analysis with feature selection to classify ransomware, achieving high AUC and detection rates, including for new families, without requiring full family data.

ABSTRACT

Recent statistics show that in 2015 more than 140 millions new malware samples have been found. Among these, a large portion is due to ransomware, the class of malware whose specific goal is to render the victim's system unusable, in particular by encrypting important files, and then ask the user to pay a ransom to revert the damage. Several ransomware include sophisticated packing techniques, and are hence difficult to statically analyse. We present EldeRan, a machine learning approach for dynamically analysing and classifying ransomware. EldeRan monitors a set of actions performed by applications in their first phases of installation checking for characteristics signs of ransomware. Our tests over a dataset of 582 ransomware belonging to 11 families, and with 942 goodware applications, show that EldeRan achieves an area under the ROC curve of 0.995. Furthermore, EldeRan works without requiring that an entire ransomware family is available beforehand. These results suggest that dynamic analysis can support ransomware detection, since ransomware samples exhibit a set of characteristic features at run-time that are common across families, and that helps the early detection of new variants. We also outline some limitations of dynamic analysis for ransomware and propose possible solutions.

Motivation & Objective

• Motivate the need for dynamic analysis to counter evasion techniques in ransomware.
• Develop a lightweight, online-capable classifier that detects ransomware from early installation traces.
• Identify the most informative dynamic features that distinguish ransomware from goodware.
• Demonstrate the effectiveness of Regularized Logistic Regression against SVM and Naive Bayes for this task.
• Assess how EldeRan complements signature-based AV and compares with VirusTotal.

Proposed method

• Dynamically analyze samples in a sandbox to collect traces (Windows API calls, Registry, File System, per-Extension File Operations, Directory Operations, Dropped Files, Strings).
• Apply Mutual Information to select the most discriminative features from a large feature set (~30k features).
• Use Regularized Logistic Regression with L2 regularization to classify samples as ransomware or goodware.
• Train offline on a labeled dataset and perform online live detection on user PCs.
• Compare performance against SVM and Naive Bayes using cross-validated feature subsets; benchmark against VirusTotal labels.

Experimental results

Research questions

• RQ1 Can ransomware be accurately detected using a limited set of dynamically-derived features collected during early execution?
• RQ2 Which dynamic feature classes contribute most to distinguishing ransomware from benign software?
• RQ3 How does Regularized Logistic Regression compare to SVM and Naive Bayes for this detection task?
• RQ4 Is EldeRan effective at detecting new ransomware families not present in the training data?
• RQ5 How does EldeRan's performance compare to VirusTotal in practical detection scenarios?

Key findings

• EldeRan achieves an area under the ROC curve (AUC) of 0.995 on a dataset of 582 ransomware samples across 11 families and 942 goodware samples.
• EldeRan detects new ransomware families with an average rate of 93.3%.
• EldeRan’s average error rate is 2.4%, while VirusTotal’s is 5.6% in the reported comparison.
• Regularized Logistic Regression outperforms Naive Bayes and is competitive with SVM, with easier online adaptation.
• Using 400 top features (out of 30,967) yields peak performance, highlighting the value of feature selection.
• EldeRan complements signature-based AV by identifying unknown/new variants that may be missed by traditional methods.