Ransomware detection using write data obtained from I/O Request Packets

In recent years, ransomware with superior to signature-based detection, such as file-less malware that leaves no traces on storage devices, has been observed. Behavior-based detection can detect such ransomware and previous unobserved ransomware. However this technique has some limitations. Some files are sacrificed before ransomware behavior is observed, and attacks that inject malicious code into normal processes are difficult to detect. In this paper, we propose a method to detect ransomware file writing that obtains the write data by ransomware or applications from I/O Request Packets and using two tests: entropy and file header. Evaluation experiments show that the proposed method can detect ransomware that excels at evading signature-based detection and behavior-based detection without producing a victim file. In addition, the short file write delay and low false positive rate when implementing the proposed method do not significantly impact the user experience, indicating that the proposed method is feasible for practical use.