Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

A Comprehensive Analysis of Machine Learning Based File Trap Selection Methods to Detect Crypto Ransomware

Mohan Anand Putrevu, Hrushikesh Chunduri, Venkata Sai Charan Putrevu, Sandeep K Shukla

TL;DR

In order to address the shortcomings of existing machine learning-based trap selection methods, the proposed APFO (Affinity Propagation with File Order) is an improvement upon existing non-parametric clustering-based trap selection methods, and it helps to reduce the amount of file loss and detection delay encountered.

Abstract

The use of multi-threading and file prioritization methods has accelerated the speed at which ransomware encrypts files. To minimize file loss during the ransomware attack, detecting file modifications at the earliest execution stage is considered very important. To achieve this, selecting files as traps and monitoring changes to them is a practical way to deal with modern ransomware variants. This approach minimizes overhead on the endpoint, facilitating early identification of ransomware. This paper evaluates various machine learning-based trap selection methods for reducing file loss, detection delay, and endpoint overhead. We specifically examine non-parametric clustering methods such as Affinity Propagation, Gaussian Mixture Models, Mean Shift, and Optics to assess their effectiveness in trap selection for ransomware detection. These methods select M files from a directory with N files (M<N) and use them as traps. In order to address the shortcomings of existing machine learning-based trap selection methods, we propose APFO (Affinity Propagation with File Order). This method is an improvement upon existing non-parametric clustering-based trap selection methods, and it helps to reduce the amount of file loss and detection delay encountered. APFO demonstrates a minimal file loss percentage of 0.32% and a detection delay of 1.03 seconds across 18 contemporary ransomware variants, including rapid encryption variants of lock-bit, AvosLocker, and Babuk.

A Comprehensive Analysis of Machine Learning Based File Trap Selection Methods to Detect Crypto Ransomware

TL;DR

In order to address the shortcomings of existing machine learning-based trap selection methods, the proposed APFO (Affinity Propagation with File Order) is an improvement upon existing non-parametric clustering-based trap selection methods, and it helps to reduce the amount of file loss and detection delay encountered.

Abstract

The use of multi-threading and file prioritization methods has accelerated the speed at which ransomware encrypts files. To minimize file loss during the ransomware attack, detecting file modifications at the earliest execution stage is considered very important. To achieve this, selecting files as traps and monitoring changes to them is a practical way to deal with modern ransomware variants. This approach minimizes overhead on the endpoint, facilitating early identification of ransomware. This paper evaluates various machine learning-based trap selection methods for reducing file loss, detection delay, and endpoint overhead. We specifically examine non-parametric clustering methods such as Affinity Propagation, Gaussian Mixture Models, Mean Shift, and Optics to assess their effectiveness in trap selection for ransomware detection. These methods select M files from a directory with N files (M<N) and use them as traps. In order to address the shortcomings of existing machine learning-based trap selection methods, we propose APFO (Affinity Propagation with File Order). This method is an improvement upon existing non-parametric clustering-based trap selection methods, and it helps to reduce the amount of file loss and detection delay encountered. APFO demonstrates a minimal file loss percentage of 0.32% and a detection delay of 1.03 seconds across 18 contemporary ransomware variants, including rapid encryption variants of lock-bit, AvosLocker, and Babuk.
Paper Structure (16 sections, 11 equations, 8 figures, 4 tables)

This paper contains 16 sections, 11 equations, 8 figures, 4 tables.

Table of Contents

  1. Introduction
  2. The major contribution of this work includes:
  3. Related Works
  4. Background
  5. Affinity Propagation
  6. Mean Shift Clustering
  7. Gaussian Mixture Models (GMM)
  8. Optics
  9. Methodology
  10. Results and Discussion
  11. File Loss
  12. Detection Delay
  13. Utilization of system resources performance impact
  14. Comparison of ML based Trap selection methods and its limitations
  15. Proposed Method for Trap Selection : APFO
  16. ...and 1 more sections

Figures (8)

  • Figure 1: Average duration of file encryption by multiple ransomware variants on 98,561 files totaling 53 GB - Reported by Splunk speedtest
  • Figure 2: Concept diagram of ML based Trap selection for Ransomware detection
  • Figure 3: Comparison of ML based trap selection methods (Criteria: File Loss across ransomware variants)
  • Figure 4: Comparison of ML based trap selection methods (Criteria: Detection Delay across ransomware variants)
  • Figure 5: Venn Diagram on the Trap files selected by 4 non-parametric clustering methods
  • ...and 3 more figures