Prognosis Negative: Evaluating Real-Time Behavioral Ransomware Detectors
Abhinav Kumar Gupta, Aditi Prakash, Nolen Scaife · 2021
Ransomware attacks continue to grow in both severity and prevalence as attackers target public infrastructure, governments, and companies. This problem has spawned a wide range of anti-ransomware techniques which are evaluated by their capability of detecting known samples, but these samples are difficult to obtain and unreliable. Due to polymorphism and the ease of implementing new methods of attack, anti-ransomware is more likely needed to protect against an unknown binary than a known sample. In this paper, we create an extensible framework (Farfel) for testing anti-ransomware products that does not rely on evaluation with known samples. Our framework consists of 21 unique fundamental behavior variations which can be selected to form 1,536 unique attacks. Using this, we evaluate seven commercial and academic anti-ransomware products to identify gaps in coverage of fundamental behaviors. Our evaluation uncovers significant gaps in every product, with three commercial products detecting zero cases. We believe that testing on a wide variety of behaviors will ultimately result in more effective detectors in the future.