Work

Rcryptect: Real-time detection of cryptographic function in the user-space filesystem

Year: 2021

Type: article

Abstract: The existing methods of ransomware detection have limitations. To be specific, static analysis is not effective to obfuscated binaries, while dynamic analysis is usually restricted to a certain platform and often takes tens of minutes. In this paper, we propose a block-level monitoring system to detect potentially malicious cryptographic operations. We carry out statistical analysis to find heuristic rules to distinguish between normal and encrypted blocks. In order to apply the heuristic rule to the filesystem without kernel modification, we adopt Filesystem in Userspace (FUSE) and define our filesystem Rcryptect for real-time detection of cryptographic function. We demonstrate the protection of well-known ransomware and show that various cryptographic functions can be detected with about 13% overhead.

Source: Computers & Security

DOI: 10.1016/j.cose.2021.102512

Authors: Seungkwang Lee, Nam-su Jho, Doyoung Chung, Yousung Kang, Myungchul Kim

Institutions: Electronics and Telecommunications Research Institute, Korea Advanced Institute of Science and Technology

Language: English

Topic: Advanced Malware Detection Techniques

Subfield: Software

Field: Computer Science

Domain: Physical Sciences

Open Access status: hybrid

Estimated APC paid: $2,920

Funders: Ministry of Science, ICT and Future Planning, Electronics and Telecommunications Research Institute, National Research Foundation of Korea