A pseudo feedback-based annotated TF-IDF technique for dynamic crypto-ransomware pre-encryption boundary delineation and features extraction

Al-Rimy, BAS, Maarof, MA, Alazab, M, Alsolami, F, Shaid, SZM, Ghaleb, FA, Al-Hadhrami, T ORCID: https://orcid.org/0000-0001-7441-604X and Alimi, AM, 2020. A pseudo feedback-based annotated TF-IDF technique for dynamic crypto-ransomware pre-encryption boundary delineation and features extraction. IEEE Access, 8, 140586 - 140598. ISSN 2169-3536

Preview

Text 1350931_a1123_Al-Hadhrami.pdf - Published version Download (7MB) | Preview

Abstract

The cryptography employed against user files makes the effect of crypto-ransomware attacks irreversible even after detection and removal. Thus, detecting such attacks early, i.e. during pre-encryption phase before the encryption takes place is necessary. Existing crypto-ransomware early detection solutions use a fixed time-based thresholding approach to determine the pre-encryption phase boundaries. However, the fixed time thresholding approach implies that all samples start the encryption at the same time. Such assumption does not necessarily hold for all samples as the time for the main sabotage to start varies among different crypto-ransomware families due to the obfuscation techniques employed by the malware to change its attack strategies and evade detection, which generates different attack behaviors. Additionally, the lack of sufficient data at the early phases of the attack adversely affects the ability of feature extraction techniques in early detection models to perceive the characteristics of the attacks, which, consequently, decreases the detection accuracy. Therefore, this paper proposes a Dynamic Pre-encryption Boundary Delineation and Feature Extraction (DPBD-FE) scheme that determines the boundary of the pre-encryption phase, from which the features are extracted and selected more accurately. Unlike the fixed thresholding employed by the extant works, DPBD-FE tracks the pre-encryption phase for each instance individually based on the first occurrence of any cryptography-related APIs. Then, an annotated Term Frequency-Inverse Document Frequency (aTF-IDF) technique was utilized to extract the features from runtime data generated during the pre-encryption phase of crypto-ransomware attacks. The aTF-IDF overcomes the challenge of insufficient attack patterns during the early phases of the attack lifecycle. The experimental evaluation shows that DPBD-FE was able to determine the pre-encryption boundaries and extract the features related to this phase more accurately compared to related works.

Item Type:	Journal article
Publication Title:	IEEE Access
Creators:	Al-Rimy, B.A.S., Maarof, M.A., Alazab, M., Alsolami, F., Shaid, S.Z.M., Ghaleb, F.A., Al-Hadhrami, T. and Alimi, A.M.
Publisher:	Institute of Electrical and Electronics Engineers (IEEE)
Date:	29 July 2020
Volume:	8
ISSN:	2169-3536
Identifiers:	Number Type 10.1109/access.2020.3012674 DOI 1350931 Other
Rights:	This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/
Divisions:	Schools > School of Science and Technology
Record created by:	Linda Sullivan
Date Added:	24 Aug 2020 10:03
Last Modified:	31 May 2021 15:13
URI:	https://irep.ntu.ac.uk/id/eprint/40499

Actions (login required)

Edit View

Statistics

Views

Downloads