RansomAI: AI-powered Ransomware for Stealthy Encryption
- URL: http://arxiv.org/abs/2306.15559v1
- Date: Tue, 27 Jun 2023 15:36:12 GMT
- Title: RansomAI: AI-powered Ransomware for Stealthy Encryption
- Authors: Jan von der Assen, Alberto Huertas Celdr\'an, Janik Luechinger, Pedro
Miguel S\'anchez S\'anchez, G\'er\^ome Bovet, Gregorio Mart\'inez P\'erez,
Burkhard Stiller
- Abstract summary: RansomAI is a framework that learns the best encryption algorithm, rate, and duration that minimizes its detection.
It evades the detection of Ransomware-PoC affecting the Raspberry Pi 4 in a few minutes with >90% accuracy.
- Score: 0.5172201569251684
- License: http://creativecommons.org/licenses/by-nc-sa/4.0/
- Abstract: Cybersecurity solutions have shown promising performance when detecting
ransomware samples that use fixed algorithms and encryption rates. However, due
to the current explosion of Artificial Intelligence (AI), sooner than later,
ransomware (and malware in general) will incorporate AI techniques to
intelligently and dynamically adapt its encryption behavior to be undetected.
It might result in ineffective and obsolete cybersecurity solutions, but the
literature lacks AI-powered ransomware to verify it. Thus, this work proposes
RansomAI, a Reinforcement Learning-based framework that can be integrated into
existing ransomware samples to adapt their encryption behavior and stay
stealthy while encrypting files. RansomAI presents an agent that learns the
best encryption algorithm, rate, and duration that minimizes its detection
(using a reward mechanism and a fingerprinting intelligent detection system)
while maximizing its damage function. The proposed framework was validated in a
ransomware, Ransomware-PoC, that infected a Raspberry Pi 4, acting as a
crowdsensor. A pool of experiments with Deep Q-Learning and Isolation Forest
(deployed on the agent and detection system, respectively) has demonstrated
that RansomAI evades the detection of Ransomware-PoC affecting the Raspberry Pi
4 in a few minutes with >90% accuracy.
Related papers
- Understanding crypter-as-a-service in a popular underground marketplace [51.328567400947435]
Crypters are pieces of software whose main goal is to transform a target binary so it can avoid detection from Anti Viruses (AVs) applications.
The crypter-as-a-service model has gained popularity, in response to the increased sophistication of detection mechanisms.
This paper provides the first study on an online underground market dedicated to crypter-as-a-service.
arXiv Detail & Related papers (2024-05-20T08:35:39Z) - Detection of ransomware attacks using federated learning based on the CNN model [3.183529890105507]
This paper offers a ransomware attack modeling technique that targets the disrupted operation of a digital substation.
Experiments demonstrate that the suggested technique detects ransomware with a high accuracy rate.
arXiv Detail & Related papers (2024-05-01T09:57:34Z) - Ransomware Detection and Classification using Machine Learning [7.573297026523597]
This study uses the XGBoost and Random Forest (RF) algorithms to detect and classify ransomware attacks.
The models are evaluated on a dataset of ransomware attacks and demonstrate their effectiveness in accurately detecting and classifying ransomware.
arXiv Detail & Related papers (2023-11-05T18:16:53Z) - FreeEagle: Detecting Complex Neural Trojans in Data-Free Cases [50.065022493142116]
Trojan attack on deep neural networks, also known as backdoor attack, is a typical threat to artificial intelligence.
FreeEagle is the first data-free backdoor detection method that can effectively detect complex backdoor attacks.
arXiv Detail & Related papers (2023-02-28T11:31:29Z) - An anomaly detection approach for backdoored neural networks: face
recognition as a case study [77.92020418343022]
We propose a novel backdoored network detection method based on the principle of anomaly detection.
We test our method on a novel dataset of backdoored networks and report detectability results with perfect scores.
arXiv Detail & Related papers (2022-08-22T12:14:13Z) - Illusory Attacks: Information-Theoretic Detectability Matters in Adversarial Attacks [76.35478518372692]
We introduce epsilon-illusory, a novel form of adversarial attack on sequential decision-makers.
Compared to existing attacks, we empirically find epsilon-illusory to be significantly harder to detect with automated methods.
Our findings suggest the need for better anomaly detectors, as well as effective hardware- and system-level defenses.
arXiv Detail & Related papers (2022-07-20T19:49:09Z) - Ransomware Detection using Process Memory [0.0]
This study focuses on the inner workings and main function of ransomware.
New signatures and fingerprints of ransomware families can be identified to classify novel ransomware attacks correctly.
Several well-known machine learning algorithms were explored with an accuracy range of 81.38 to 96.28 percents.
arXiv Detail & Related papers (2022-03-31T08:03:48Z) - Mate! Are You Really Aware? An Explainability-Guided Testing Framework
for Robustness of Malware Detectors [49.34155921877441]
We propose an explainability-guided and model-agnostic testing framework for robustness of malware detectors.
We then use this framework to test several state-of-the-art malware detectors' abilities to detect manipulated malware.
Our findings shed light on the limitations of current malware detectors, as well as how they can be improved.
arXiv Detail & Related papers (2021-11-19T08:02:38Z) - Scalable Backdoor Detection in Neural Networks [61.39635364047679]
Deep learning models are vulnerable to Trojan attacks, where an attacker can install a backdoor during training time to make the resultant model misidentify samples contaminated with a small trigger patch.
We propose a novel trigger reverse-engineering based approach whose computational complexity does not scale with the number of labels, and is based on a measure that is both interpretable and universal across different network and patch types.
In experiments, we observe that our method achieves a perfect score in separating Trojaned models from pure models, which is an improvement over the current state-of-the art method.
arXiv Detail & Related papers (2020-06-10T04:12:53Z) - Towards a Resilient Machine Learning Classifier -- a Case Study of
Ransomware Detection [5.560986338397972]
A machine learning (ML) classifier was built to detect ransomware (called crypto-ransomware)
We find that input/output activities of ransomware and the file-content entropy are unique traits to detect crypto-ransomware.
In addition to accuracy and resiliency, trustworthiness is the other key criteria for a quality detector.
arXiv Detail & Related papers (2020-03-13T18:02:19Z)
This list is automatically generated from the titles and abstracts of the papers in this site.
This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.