Análise Híbrida de Ransomware para Sistema Operacional Windows

Abstract

The growth of access to computing devices has greatly increased since the early 2000s. The miniaturization of electronic components, advances in battery technology and screens have made these devices more affordable, allowing individuals to own multiple devices (such as tablets, phones, computers, and smart home devices). However, this rapid growth does not necessarily come with an increased security mindset. The massive amount of data generated by interacting with these devices has attracted the interest of groups with malicious intent, and all sorts of malicious software are created daily to exploit and gain access to these devices. Among these malicious software, ransomware stands out as a weapon capable of encrypting all of a victim’s files, forcing them to pay a ransom in order to regain access to their data. In this work, we conducted a series of experiments to dynamically evaluate Machine Learning techniques for malware detection and classification into their respective families. To perform the experiments, we collected a total of 989 samples of ransomware from the eight most prominent families in 2021 and 2022, downloaded from public repositories: Conti, Ryuk, Revil, Egregor, LockBit, Clop, Netwalker, and MountLocker, in addition to 90 samples of benign software. First, we set up a controlled/isolated environment to record the behavior of the ransomware for evaluating Machine Learning techniques in terms of commonly used performance metrics such as Accuracy, Precision, Recall, and F1-Measure. We used the Cuckoo Sandbox to execute the analyses. We developed Python tools to automate tasks such as searching for samples in public repositories and data mining to compose the detection datasets. From the execution reports saved in the form of JSON reports, we employed text mining and API call techniques applied in tools we specifically built to extract a promising set of data representing the behavior of a ransomware sample. We then subjected the datasets to classification using six Machine Learning algorithms: Decision Tree, Random Forest, K-Nearest Neighbors, Naive Bayes, Support Vector Machines, and Multilayer Perceptron. The main motivation for conducting the experiments is that different techniques were designed to optimize different criteria, which behave differently even under similar conditions. The experimental results show that the proposed methods can achieve good classification performance when using the Random Forest and Decision Tree algorithms. The best classification results were achieved with these classifiers in three situations: the first and second using the mined dataset by applying the TF-IDF text mining technique to the Signatures and Memory sections of the analysis reports, and the third using the mined dataset based on the API call count. In addition to classification, we revealed the guidelines used to protect the analysis environment from anti-VM tools, both for configuring the operating system and network connectivity used.