Early Detection of Ransomware by Indicator Analysis and WinAPI Call Sequence Pattern

Abstract

In the present paper, an analytical study has been done on a specific type of malware that is ransomware. Recent events all over the globe suggest ransomware as the growing threat because it encrypts targeted data of victim and keeps the decryption key with itself until a fair amount of ransom is paid, generally through cryptocurrency. Also its new variants keep coming up with better and stronger application, stay undetected of anti-malware software and intrusion detection systems. The idea for this paper was to develop an early detection system dedicated to ransomware. We took dynamic malware analysis approach for this paper. Behavioral study was done on 300 downloaded ransomware, also by making our own ransomware and understanding its background working (for Windows platform) and general modus operandi. Sets of behavioral indicators and Microsoft Detours libraries were used to hook Windows API call sequences to understand run-time behavior and filter out the ransomware from Benign software. The achievement of the present work is an automated framework which can be used to make user’s system protected from ransomware.