Pre-Encryption and Identification (PEI): An Anti-crypto Ransomware Technique
Aditya Mantri, Navjot Singh, Krishan Kumar, Sanjay Dahiya · IETE Journal of Research · 2022
Due to the growing popularity of digital currencies like Bitcoin, criminals have begun producing and marketing ransomware to obtain virtual currency. This work focuses on the main category (crypto-ransomware) of ransomware attacks, making the victim's data impossible to recover once it has been encrypted. It encrypts its victim's files with an encryption algorithm and tries to extort a ransom from the victim. To identify a crypto-ransomware attack at the pre-encryption level, the authors propose a Pre-Encryption and Identification Technique (PEI). Firstly, PEI provides early identification of ransomware. The detection stage uses a signature comparison against the signatures of known crypto-ransomware to detect ransomware before it can be triggered. For reliable file comparison, a Secure Hashing Algorithm (SHA-256) signature was generated. Secondly, a detection stage based on a Learning Algorithm (L.A.) consisting of discretization and prediction using a random forest model finds crypto-ransomware through pre-encryption Application Programming Interfaces (APIs). APIs pattern recognition helps the learning algorithm identify crypto-ransomware from suspicious programs. The proposed PEI achieved 97.7% recall and detected both known and unknown crypto-ransomware even before they were implemented.