LSTM Autoencoder-based Ransomware detection using deep anomaly detection

Aqeel Jameel Kaduam; Morteza Valizadeh; Mehdi Chehel Amirani

Author(s)

Aqeel Jameel Kaduam Department of electrical and computer engineering, Urmia University, Urmia, Iran

Morteza Valizadeh Department of electrical and computer engineering, Urmia University, Urmia, Iran

Mehdi Chehel Amirani Department of electrical and computer engineering, Urmia University, Urmia, Iran

Abstract

In recent years, with the development of various encryption methods and non-recoverable payments, ransomware has become one of the most critical cyber threats, targeting a wide range of victims. Consequently, ransomware detection has become a significant research field among malware detection researchers. The study of ransomware detection mechanisms and approaches shows that it is impossible to detect unknown ransomware early using existing methods. To address this challenge, this study proposes an in-depth learning method for the early detection of ransomware. In the proposed method, the LSTM Autoencoder neural network is used to model the sequence of input/output request (IRP) packets of normal processes. Processes created outside the model are classified as anomalous processes.For this purpose, several attributes are first extracted from the events recorded by the IRPLogger program. The extracted features are then used to train the model with the LSTM Autoencoder network. Finally, by determining a threshold value, the model training obtained from normal processes is used to detect anomalies. To evaluate the proposed method, datasets including 15 common samples (220 anomalous processes) and 30 common ransomware samples have been generated. The experimental results show that the proposed method, for 5000 initial input/output request packets of each process, has a true positive rate of 97.8% and a false positive rate of 2.1%, making it suitable for the early detection of unknown ransomware.

Publication Details

Page(s) 231-251

DOI DOI not available

Published Journal: International Journal of Communication Networks and Information Security, Volume: 16, Issue: 5, Year: 2024

Request the full text from PASTIC

Keywords

deep learning, early detection, I/O Request Packet, ansomware, Anomaly Detection Anomaly Sequence

References

Johnson Joseph,worldwide Joseph .2021 .-per-year-. , : .

Pathak P. B. .2016 .A Dangerous Trend of Cybercrime: Ransomware Growing Challenge,”. Int. J. Adv. Res. Comput. Eng. Technol., 5(2) : 371-373.

Fox R. .2016 .The true cost. , 32(4) : 232-238.

wave .2021 .-security-awareness-ransomware-. , : .

Medhat M.,Gaber S.,Abdelbaki N. .2018 .A new static-based framework for ransomware detection. ” Proc. - IEEE 16th Int. Conf. Dependable, Auton. Secur. Comput., : 710-715.

D. O'Brien .2017 .. Internet Security Threat Report - Ransomware, : 35.

Al-rimy B. A. S.,Maarof M. A.,Shaid S. Z. M. .2018 .Ransomware threat success factors, taxonomy. , 74 : 144-166.

Kok S. H.,Abdullah A.,Jhanjhi N. Z.,Supramaniam M.,Techniques Detection .2019 .. ” IJCSNS Int. J. Comput. Sci. Netw, 19(2) : 136.

Kharraz A.,Robertson W.,Balzarotti D.,Bilge L. .2015 .Cutting the gordian knot: A look under the hood of ransomware attacks. ” Lect. Notes Comput. Sci. (including Subser. Lect. Notes Artif. Intell. Lect. Notes Bioinformatics), 9148 : 3-24.

Sgandurra D.,Muñoz-González L.,Mohsen R.,Lupu E. C. .2016 .. Automated Dynamic Analysis of Ransomware: Benefits, : .

Chandola V.,Banerjee A.,Kumar V. .2009 .Outlier detection: A survey,” ACM Comput. January, : .

Chalapathy R.,Chawla S. .2019 .Deep Learning for Anomaly Detection:. , : 1-50.

Genç Z. A.,Sgandurra D. .2019 .On deception-based protection against cryptographic ransomware. ” Lect. Notes Comput. Sci. (including Subser. Lect. Notes Artif. Intell. Lect. Notes Bioinformatics), 11543 : 219-239.

Yuill J.,Zappe M.,Denning D.,Feer F. .2004 .Deceptive files for intrusion detection. June, : 116-121.

Bowen B. M.,Hershkop S.,Keromytis A. D.,Stolfo S. J. .2009 .Baiting inside attackers using decoy documents. ” Lect. Notes Inst. Comput. Sci. Soc, 19 : 51-70.

Yosifovich P. .2019 .. CreateSpace Independent Publishing Platform, : 152-336.

Palisse A.,Durand A.,Le Bouder H.,Le Guernic C.,Lanet J. L. .2017 .Data aware defense (DaD): Towards a generic and practical ransomware countermeasure. ” Lect. Notes Comput. Sci. (including Subser. Lect. Notes Artif. Intell. Lect. Notes Bioinformatics), 10674 : 192-208.

.2021 .. -concepts, : .

drivers .2021 .-order-groups-and-altitudes-for-minifilter-. , : .

Bengio Y. .2009 .Learning deep architectures for AI. , 2(1) : .

Gulli A. and S. P. .2017 .Deep Learning with Keras. , : .

Arden Dertat .2017 .-learning-. part-1-artificial-neural-networksd7834f67a4f6, : .

Rumelhart D. E.,Hinton G. E.,Williams R. J. .1986 .Learning representations by back-propagating errors. ” Nature, 323(6088) : 533-536.

Graves A. .2014 .Generating Sequences With Recurrent Neural Networks. , : 1-43.

Goodfellow I.,Bengio Y.,Courville A. .2016 .Deep Learning. , : .

Hochreiter S.,Short-Term “Long,Memory “Long .1997 .. , 1780 : 1735-1780.

Olah C. .2015 .. , : 1-13.

Bourlard H.,Kamp Y.,Biol. Cybern. Y. .1988 .Auto-association by multilayer perceptrons and singular value decomposition,”. , 59(4-5) : 291-294.

Hinton G. E.,Zemel R. S. .1994 .. Minimum Description Length and Helmholtz free Energy,” Adv. Neural Inf. Process. Syst., 6 : 3-10.

Holden A. J. .2006 .. July, 313 : 504-507.

Scaife N.,Carter H.,Traynor P.,K. R. B. Butler P. .2016 .CryptoLock (and Drop It): Stopping Ransomware Attacks on User Data,”. 2016-Augus, : 303-312.

Shukla M.,Mondal S.,Lodha S. .2016 .Locally virtualizedenvironment for mitigating ransomware threat. ” Proc. ACM Conf. Comput. Commun. Secur., 24 : 1784-1786.

A. Continellaet al. .2016 .“ShieldFS : A Self-healing , Ransomware-aware Filesystem. , : .

Kolosnjaji B.,Zarras A.,Eckert C. .2017 .Deep learning for classification of malware system call sequences. ” Lect. Notes Comput. Sci. (including Subser. Lect. Notes Artif. Intell. Lect. Notes Bioinformatics), 9992 : 137-149.

Hampton N.,Baig Z.,Zeadally S.,Inf J. .2018 .Ransomwarebehavioural analysis on windows platforms,”. Secur. Appl., 40 : 44-51.

Subedi K. P.,Budhathoki D. R.,Dasgupta D. .2018 .Forensic analysis of ransomware families using static and dynamic analysis. May, : 180-185.

Mehnaz S.,Mudgerikar A. .2018 .. , 7462 : .

Zhang H.,Xiao X.,Mercaldo F.,Ni S.,Martinelli F.,Sangaiah A. K.,Futur. Gener. Comput. Syst. A. K. .2019 .Classification of ransomware families with machine learning based on N-gram of opcodes,”. , 90 : 211-221.

Agrawal R.,Stokes J. W.,Selvaraj K.,Marinescu M. .2019 .. , : 3222-3226.

Jha S.,Prashar D.,Long H. V.,Taniar D. .2020 .Recurrent neural network for detecting malware. ” Comput. Secur., 99 : 102037.

Mikolov T.,Chen K.,Dean J. .2013 .Distributed representations ofwords and phrases and their compositionality. ” Adv. Neural Inf. Process. Syst., : 1-9.

Ayub M. A.,Continella A.,Siraj A. .2020 .An I/O Request Packet (IRP) Driven Effective Ransomware Detection Scheme using Artificial Neural Network,”. Proc. - 2020 IEEE 21st Int. Conf. Inf. Reuse Integr. Data Sci. IRI, : 319-324.

Russinovich M. .2021 .. , : 86.

layersffab055b6352 .2019 .-step-understanding-lstm-autoencoder-. , : .

Aurangzeb S.,Rais R. N. Bin,Aleem M.,Islam M. A.,Iqbal M. A. .2021 .On the classification of Microsoft-Windows ransomware using hardware profile,” PeerJComput. February, 7 : 1-24.

Alaghbari Khaled A.,Heng-Siong Lim .2023 ."Deep Autoencoder-Based Integrated Model for Anomaly Detection and Efficient Feature Extraction in IoT Networks." IoT 4. , (3) : 345-365.

Zahoora Asifullah,Khan Asifullah .2022 ."Zero-day ransomware attack detection using deep contractive autoencoder and voting based ensemble classifier. " Applied Intelligence, 12 : 13941-13960.