Ransomware Early Detection Method Based on API Latent Semantics

被引：0
作者：
Luo B. [1 ]
Guo C. [1 ]
Shen G.-W. [1 ]
Cui Y.-H. [1 ]
Chen Y. [1 ]
Ping Y. [2 ]
机构：
[1] State Key Laboratory of Public Big Data, College of Computer Science and Technology, Guizhou University, Guizhou, Guiyang
[2] School of Information Engineering, Xuchang University, Henan, Xuchang
来源：
Tien Tzu Hsueh Pao/Acta Electronica Sinica | 2024年 / 52卷 / 04期
基金：
中国国家自然科学基金;
关键词：
API; early detection; latent semantic analysis; random forest; ransomware; TF-IDF;
D O I：
10.12263/DZXB.20231039
中图分类号：
学科分类号：
摘要：
Cryptographic ransomware extorts a ransom by encrypting user files. Existing early detection methods based on the first encryption-related application programming interface (API) cannot detect ransomware before it executes encryption behavior. Because the point at which different ransomware families begin executing their encryption behavior varies, existing early detection methods based on fixed time thresholds can only accurately detect a small fraction of ransom⁃ ware before it executes encryption behavior. To further improve the timeliness of ransomware detection, this article propos⁃ es a concept that characterizes the time period from the start of software operation to the first call of encryption-related dy⁃ namic-link libraries (DLLs), namely the initial phase of operation (IPO). Based on the analysis of DLL and API call behavior in the early operational phase of several ransomwares, this article presents a method based on the API sequences generated by the software within the IPO as the detection object, namely the ransomware early detection method based on API latent seman⁃ tics (REDMALS). REDMALS captures the API sequences within the IPO, uses the term frequency-inverse document frequen⁃ cy algorithm and the latent semantic analysis algorithm to generate feature vectors on the captured API sequences and to ex⁃ tract potential semantic structures, respectively, and then uses a machine learning algorithm to construct a detection model for ransomware detection. The experimental results show that REDMALS using the random forest algorithm achieves 97.7% and 96.0% accuracy on the constructed variant test set and unknown test set, respectively, and 83% and 76% of the ransom⁃ ware samples in both test sets, respectively, can be detected before they perform any encryption behavior. © 2024 Chinese Institute of Electronics. All rights reserved.
引用
收藏
页码：1288 / 1295
页数：7
相关论文
共 16 条
  • [1] BRAUE D., Global ransomware damage costs predicted to exceed $265 billion by 2031
  • [2] MCINTOSH T, KAYES A S M, CHEN Y P P, Et al., Ran⁃ somware mitigation in the modern era: A comprehensive review, research challenges, and future directions, ACM Computing Surveys, 54, 9, (2021)
  • [3] KHAMMAS B M., Ransomware detection using random forest technique, ICT Express, 6, 4, pp. 325-331, (2020)
  • [4] ZHANG B, XIAO W T, XIAO X, Et al., Ransomware clas⁃ sification using patch-based CNN and self-attention net⁃ work on embedded N-grams of opcodes, Future Genera⁃ tion Computer Systems, 110, pp. 708-720, (2020)
  • [5] DENG X Z, CEN M C, JIANG M, Et al., Ransomware ear⁃ ly detection using deep reinforcement learning on portable executable header[J/OL], Cluster Computing, (2023)
  • [6] JETHVA B, TRAORE I, GHALEB A, Et al., Multilayer ransomware detection using grouped registry key opera⁃ tions, file entropy and file signature monitoring, Journal of Computer Security, 28, 3, pp. 337-373, (2020)
  • [7] QIN B, WANG Y L, MA C C., API call based ransomware dynamic detection approach using TextCNN, 2020 In⁃ ternational Conference on Big Data, Artificial Intelligence and Internet of Things Engineering (ICBAIE), pp. 162-166, (2020)
  • [8] GULMEZ S, GORGULU KAKISIM A, SOGUKPINAR I., XRan: Explainable deep learning-based ransomware detec⁃ tion using dynamic analysis, Computers & Security, 139, (2024)
  • [9] LIU W J, GUO C, SHEN G W, Et al., Ransomware early detection method based on deep learning, Computer Sci⁃ ence, 50, 3, pp. 391-398, (2023)
  • [10] ALI SALEH AL-RIMY B, MAAROF M A, ALAZAB M, Et al., Redundancy coefficient gradual up-weighting-based mutual information feature selection technique for crypto-ransomware early detection, Future Generation Computer Systems, 115, pp. 641-658, (2021)
12