RansomSentry: Runtime Detection of Android Ransomware With Compiler-Based Instrumentation
Boyang Ma, Linxuan Zhou, Chong Liao, Yajin Zhou, Jinku Li, Jianfeng Ma · IEEE Transactions on Dependable and Secure Computing · 2025
In recent years, mobile ransomware attacks have become increasingly prevalent, especially in Android systems. Android ransomware extorts users by maliciously locking infected devices or encrypting user files on the devices. To address this problem, we proposeRansomSentry, a runtime detection system with compiler-based instrumentation against both lock-screen and crypto ransomware in Android. Specifically,RansomSentryleverages a modified Androiddex2oatcompiler to instrument the sensitive APIs invoked by ransomware during the installation of a target app, and monitors the app's screen-related and file access operations at runtime to detect attacks. Compared to previous solutions,RansomSentrydoes not require to change the app's APK file and bytecode, thus it will pass the original integrity check of the app, which makes it readily deployed by users. Further, such a dynamic approach is naturally immune to code or data obfuscation and can provide real-time protection. To validate our approach, we implement a prototype ofRansomSentryand collect 2,376 recent Android ransomware samples to evaluate it. The evaluation results show that our prototype can effectively detect ransomware attacks with an acceptable performance overhead.