Towards Live Detection of Ransomware Attacks

Ransomware attacks continue to be a top risk for organizations today. Recent studies focused on the behavioral and runtime analysis of ransomware. However, these studies have limitations such as continual monitoring of the target system. Furthermore, most studies are limited to post-mortem analysis using machine learning (ML) and deep learning (DL) models for ransomware detection, which may need to be tuned for live detection. In this paper, we investigate the challenges involved with live detection of ransomware activity in virtual machines (VMs) and propose a framework to overcome those challenges. The framework collects VM activity data using hardware per-formance counters and disk I/O tools from the hypervisor or host machine. We implemented several ML models and evaluated them with 105 ransomware and 4 benign applications running on six VMs with different user workloads. The model performed best with the random forest (RF) classifier, and can detect ransomware activity with less than 0.14% of user files lost and a false trigger every four minutes. We also implemented a secondary verification of the triggers by the model to increase the false trigger interval to virtually infinite with a high probability at the cost of increased file-loss rate (2.4%) when there is ransomware activity.