Dynamic Analysis of Ran-somware using Opcodes and Opcode Categories
Domhnall Carlin, Philip O’Kane, Sakir Sezer · International Journal on Cyber Situational Awareness · 2018
The explosion of ransomware in recent years has served as a costly reminder that the malware threatscape has moved from that of socially-inept hobbyists to career criminals.This paper investigates the efficacy of dynamic opcode analysis in distinguishing cryptographic ransomware from benignware, and presents several novel contributions.Firstly, a new dataset of cryptoransomware dynamic run-traces, the largest of its kind in the literature.We release this to the wider research community to foster further research in the field.Our second novel contribution demonstrates that a short run-length of 32k opcodes can provide highly accurate detection of ransomware (99.56%) compared to benign software.Third, our model offers a distinct advantage over other models in the literature, in that it can detect a form of benign encryption (i.e.file zipping) with 100% accuracy against not only ransomware, but also the non-encrypting benignware in our dataset.The research presented here demonstrates that dynamic opcode tracing is capable of detecting ransomware in comparable times to static analysis, without being thwarted by obfuscation tactics.