Not on my watch: ransomware detection through classification of high-entropy file segments

Identifier:  imarina:9452218

Handle: https://hdl.handle.net/20.500.11797/imarina9452218

Authors:  Casino, Fran; Hurley-Smith, Darren; Hernandez-Castro, Julio; Patsakis, Constantinos

Abstract:
The double-edged sword of continuous digitization of services and systems opens the door to a myriad of beneficial opportunities, as well as challenging threats. Currently, ransomware is catalogued as the first threat in cybersecurity due to its impact on organizations, critical infrastructure, industry, and society as a whole. Thus, devoting efforts toward developing methodologies to effectively prevent and mitigate ransomware is crucial. In this article, we present an accurate method to identify encrypted bit streams by differentiating them from other high-entropy streams (e.g. compressed files), which is a critical task to detect potentially malicious file write events on the file system in current operating systems. After extensive evaluation, our findings demonstrate that the proposed solution outperforms the current state of the art in both adaptability and accuracy, enabling it to be integrated into current Endpoint Detection and Response systems.