Pre-Encryption and Identification (PEI): An Anti-crypto Ransomware Technique

Abstract

Due to the growing popularity of digital currencies like Bitcoin, criminals have begun producing and marketing ransomware to obtain virtual currency. This work focuses on the main category (crypto-ransomware) of ransomware attacks, making the victim's data impossible to recover once it has been encrypted. It encrypts its victim's files with an encryption algorithm and tries to extort a ransom from the victim. To identify a crypto-ransomware attack at the pre-encryption level, the authors propose a Pre-Encryption and Identification Technique (PEI). Firstly, PEI provides early identification of ransomware. The detection stage uses a signature comparison against the signatures of known crypto-ransomware to detect ransomware before it can be triggered. For reliable file comparison, a Secure Hashing Algorithm (SHA-256) signature was generated. Secondly, a detection stage based on a Learning Algorithm (L.A.) consisting of discretization and prediction using a random forest model finds crypto-ransomware through pre-encryption Application Programming Interfaces (APIs). APIs pattern recognition helps the learning algorithm identify crypto-ransomware from suspicious programs. The proposed PEI achieved 97.7% recall and detected both known and unknown crypto-ransomware even before they were implemented.

KEYWORDS:

• Application programming interfaces
• Cryptography
• Encryption
• Hacking
• Hashing
• Intrusion detection
• Machine learning
• Ransomware

Acknowledgments

The authors express their gratitude to the Department of Science & Technology (DST), India, for the obtained financial support in performing this research work. This work is one of the project's outcomes entitled “Secret Sharing Scheme based technology for multimedia security over the cloud” with sanction no. DST/ICPS/Cluster/CS Research/2018 (General) dated 13.03.2019, sponsored by DST.

DISCLOSURE STATEMENT

No potential conflict of interest was reported by the author(s).

Additional information

Notes on contributors

Aditya Mantri

Aditya Mantri is working with MNNIT Allahabad. His areas of interest are security, computer vision, and cryptography.

Navjot Singh

Navjot Singh is working as an assistant professor at the Indian Institute of Information Technology, Allahabad, India. He obtained MTech (Computer Science and Technology) and PhD (Computer Science) from Jawaharlal Nehru University, New Delhi, India. He is a senior member IEEE. His current research areas include salient object detection, video event summarization, computer vision, image processing, pattern recognition, machine learning, biomedical image analysis, and intelligent transportation systems. Email: [email protected]

Krishan Kumar

Krishan Kumar is shouldering the responsibility as head of the Department in Computer Science & Engineering, National Institute of Technology, Uttarakhand (NITUK), India. Recently, he joined the Editorial Board of IETE Journal of Research. He has more than ten years of Industry, teaching, research, and administrative experience, he received PhD in computer science & engineering, Visvesvaraya National Institute of Technology, Nagpur, India, in 2019. He supervised 06 MTech Students and leading 04 PhD scholars. He has organized and attended more than 30 Workshops/STTP/STC/FDP, including one international conference. He published more than 75 articles in reputed international conferences, book chapters, and reputed journals, including IEEE Transactions. Currently, Dr. Kumar is working on a DST-sponsored project titled “Secret Sharing Scheme Based Technology for Multimedia Security over Cloud.” His research interests include video processing, machine learning, deep learning, cloud computing, natural language processing. He is Senior Member IEEE and ACM a Lifetime member for ISTE, IETE, and IAPR. He is a reviewer of IEEE TMM, IEEE TNNLS, IEEE TITS, IEEE TII, IEEE TIE, and many more. Email: [email protected]

Sanjay Dahiya

Sanjay Dahiya is working as associate professor in the Department (Computer Science and Engineering) and head of Department (CSE) at Ch Devi Lal State Institute of Engineering and Technology Panniwala Mota (Sirsa) - Haryana, India-125077. He is PhD (2013) in computer science and engineering from Ch Devi Lal University, Sirsa-Haryana, India. He obtained the MTech (Computer Science and Engineering) in 2001 from Kurukshetra University Kurukshetra, India. His areas of interest are software testing, database system, system simulation, operating system, design of algorithm & analysis, implementation of information and communication technology in various fields. He has more than 50 research papers publications in international/national journals and conferences. He is also a Member of the Editorial Advisory Board of the International Journal of Computer Science. He reviews many research papers for international journals, project proposal/project completion report, national/international conference/workshop/seminar, etc. He has more than 19-year teaching, research, and administrative experience. Email: [email protected]