11institutetext: Defence Institute of Advanced Technology, Pune, India
22institutetext: 22email<EMAIL_ADDRESS>
# Leveraging Machine Learning for Ransomware Detection

Nanda Rani 1122 0000-0003-1255-5284 Sunita Vikrant Dhavale 1122
0000-0003-0306-6198

###### Abstract

The current pandemic situation has increased cyber-attacks drastically
worldwide. The attackers are using malware like trojans, spyware, rootkits,
worms, ransomware heavily. Ransomware is the most notorious malware, yet we
didn’t have any defensive mechanism to prevent or detect a zero-day attack.
Most defensive products in the industry rely on either signature-based
mechanisms or traffic-based anomalies detection. Therefore, researchers are
adopting machine learning and deep learning to develop a behaviour-based
mechanism for detecting malware. Though we have some hybrid mechanisms that
perform static and dynamic analysis of executable for detection, we haven’t
any full proof detection proof of concept, which can be used to develop a full
proof product specific to ransomware. In this work, we have developed a proof
of concept for ransomware detection using machine learning models. We have
done detailed analysis and compared efficiency between several machine
learning models like decision tree, random forest, KNN, SVM, XGBoost and
Logistic Regression. We obtained 98.21% accuracy and evaluated various metrics
like precision, recall, TP, TN, FP, and FN.

###### Keywords:

Ransomware Machine Learning Malware Cyber Security.

##  1 Introduction

The US colonial pipeline was recently attacked by ransomware named DarkSide
and paid $ 4.4 million ransom, which was requested in ransom note [1]. The
attackers stole approx. 100GB data and threatened to leak if the ransom was
not being paid. Due to the attack, the country faced fuel shortages and
disruption in oil-related services. Nowadays, Attackers are primarily
targeting critical infrastructure to disrupt the services that can harm and
affect a country population or even a human life if healthcare is being
targeted. In history, ransomware has also compromised health care, which
causes even human life in danger. Not only critical infrastructure but some
giant companies are also being targeted by ransomware, and they are pressured
to pay the ransom to get their system access and data back. Attackers
generally encrypt victim’s data with their key, and they return the key or
decrypt the data after victims pay them demanded ransom. Earlier, ransomware
was only disrupting the services and making the data unavailable to the
victim; they were still safely stored only on their system. But nowadays, data
is also being stolen by attackers, threatening the victim to pay the ransom.
Though it is not guaranteed that data can get back after paying the ransom or
they didn’t leak the stolen data.

Ransomware is a class of malware that encrypts the victim data and make them
not accessible to the victim. An attacker generally displays a ransom note
after encrypting the victim data, which usually states that the attack has
been performed and demanded ransom. The steps to make the payment they also
provided with that ransom note only. Some of the attackers also create a
negotiation window for ransom negotiation. Ransoms are typically demanded in
bitcoins because of their anonymity, so attackers cannot get tracked from
payment gateway [2]. Ransomware is categorized into two types [3]: (1) Locker
ransomware, (2) Crypto ransomware.

Locker ransomware only locks the system, and the victim won’t be able to use
the system. Ransom notes usually displayed by attackers consist of payment
information. This attack usually happens by locking the victim’s desktop or
displaying a ransom note that never closes. Victim data is not compromised in
this attack, and in some cases, there is a recovery option to restart the
system in safe mode and perform countermeasures. Sometimes locker ransomware,
also known as Screen-Locker ransomware [4]. Crypto ransomware encrypts the
user files and adds their extension to the victim files, which makes them
inaccessible to use. In some cases, data is also being stolen during
communication between the victim system and command & control. After
encryption, a ransom note usually displays consisting of payment information
and demanded ransom. Sometimes crypto-ransomware is also known as File-Locker
ransomware [4]. If we think from the CIA triad perspective, availability
compromises in any locker ransomware attack. But in the case of crypto-
ransomware, Integrity and availability compromise typically, and in some
cases, confidentiality also compromises.

Numerous ransomware variants have been introduced yet, such as WannaCry [9],
Cryptowall [5], Gancrab [6] , REvil [10], Jigsaw [11], Ryuk [12], Petya [13],
Cryptolocker [7], Teslacrypt [8]. WannaCry ransomware attack was a notorious
attack that occurred worldwide in 2017 and affected 150 countries [14]. Many
healthcare services and hospitals were affected during this attack period.
Attackers have exploited the EternalBlue vulnerability in the SMB (Server
Message Block) protocol of Windows frameworks [15]. Wannacry, Cryptolocker
ransomware came into the picture in 2013, and it was the highest ransom of its
time and infected millions of windows systems [9]. Like cyber kill chain
process, One of the Exabeam threat research report generalized ransomware
attack flow kill chain process in six stages shown in Figure 1 [16]:

  1. 1.

_Distributed Campaign:_ Victims are tricked by the attacker to download their
dropper code using various techniques such as social engineering.

  2. 2.

_Malicious Code Injection:_ Dropper code download and ransomware executable
introduce to the victim machines.

  3. 3.

_Malicious Payload Staging:_ Insert ransomware into the victim system and
create a persistence connection with the command & control server.

  4. 4.

_Scanning:_ Compromised system and network reachable resources being scanned
by installed executables for encryption.

  5. 5.

_Encryption:_ All targeted data will be encrypted in this stage.

  6. 6.

_Payday:_ After encryption, a ransom note will be displayed, and data will be
inaccessible to use for the victim.

Figure 1: Ransomware attack flow kill-chain stages.

Encryption techniques used by ransomware are (1) Symmetric encryption, (2)
Asymmetric encryption, and (3) Hybrid encryption. Attackers use a single key
for encryption and decryption in symmetric encryption. They share a common key
while communicating with the C&C server or encode the key with dropper code.
Forensic experts can extract the common key if it is encoded with dropper
code. While attackers use different keys for encryption and decryption in
asymmetric keys, it would be challenging to extract them using forensic
methods. But communication made during key distribution between the victim
system and C&C server can be captured by monitoring traffic. But it fails when
attackers use proxy servers to communicate with a compromised system.
Afterwards, attackers started using a hybrid encryption technique, in which
files would be encrypted by symmetric key only, but another asymmetric key
will encrypt that symmetric key. So, if forensic teams extract the symmetric
key, they won’t be able to use it as it is encrypted with asymmetric
encryption, whose decryption is with the attacker only.

The attacker also uses various obfuscation techniques to evade themselves in
the system [17]. Malware tries to check inconsistencies in hardware like
number of CPU cores to investigate sandbox existence. If the malware finds its
execution in the sandbox environment, they hide their malicious indication or
behaviours during analysis. Nowadays, most sandbox merchants try to hide their
genuine configuration to trick the malware into confidence that it is being
executed within the actual host. Several static analysis tools can unpack the
packed malware and then unpacked malware can be used for analysis.

##  2 Literature Review

To analyze ransomware, we have different ways to evaluate any executables: (1)
Static Analysis - In this method, executables are being examined without
running them, and it is useful to detect malicious infrastructure, library or
packed files. Technical indicators are recognized, like file name, hash, a
string such as IP address, domain name, and file’s header data, which can get
utilized to decide whether that file is malicious or not. In addition, tools
like disassemblers and network analyzers can spot the malware without actually
running it to collect evidence on how that executable malware works. (2)
Dynamic Analysis: - In dynamic malware analysis, it executes suspected
malicious code or programs in a safe environment called a sandbox. This closed
system allows security professionals to investigate the malware in action
without the risk of letting it infect the targeted system or escape into the
enterprise network. Cuckoo sandbox is the most useful tool when it comes to
analyzing malware dynamically. (3) Hybrid Analysis: It delivers the security
team the best of both approaches by merging static and dynamic analysis
techniques. It can detect malicious programs that hide themselves and then
extract many indicators of compromise (IOCs) by statically and previously
unseen programs. It also helps to detect unknown threats, even those from the
utmost sophisticated malware.

The signature-based protection works on the concept of having a signature
covering the families of ransomware. We can consider a signature as a
“fingerprint”. The detection system matches files signatures from the stored
signature database. This system works relatively well for known malware but
does not cover threats they know about, i.e., zero-day threats. Abnormal
traffic detection is considered as one step up from signature-based detection.
Anomalous traffic is detected based on many different parameters like network
intrusion detection (NID) and other traffic detections recognized as
malicious. The main shortcoming of using the abnormal traffic detection method
is its high false-positive rate. Hence, there is a decent chance that genuine
network traffic can get identified inaccurately. Thus, we need to monitor
process activity and the host’s backend operations to decide ransomware
infection presence. Due to the emerging Machine Learning technology, it’s
proving a vital role in monitoring endpoint properties and identifying
patterns of system activities for any malware. When machine learning is
implemented in file behaviour detection in any system, this can create an
effective solution for detecting ransomware. Machine Learning (ML) is similar
to human learning in a sense. Legitimate program execution and application
present a specific type of behaviour. Over time, ML “learns” how genuine,
regular programs act by taking in enormous amounts of data facts through
dedicated investigation that may include interactive debugging. In this
detailed and inclusive investigation of legitimate program execution, ML
develops very good at recognizing programs that are impersonators and have
malicious intentions.

There are different methods and techniques to detect ransomware [18, 19, 20].
Static analysis-based methods disassemble source code without executing it.
But they suffer from high false-positive rates and fails to detect obfuscated
ransomware. New variants are coming up frequently, and attackers use different
packing techniques to mutate their codes. Researchers are moving towards
dynamic behaviour analysis-based methods that monitor the interactions of the
executed code in a virtual environment for fighting these issues. However,
these detection methods are slower and require considerable memory resources.
The machine learning approach is best suited for the analysis of the behaviour
of any process or application.

Various researchers have focused on either host-based artefact analysis or
network-based artefacts analysis to develop an effective defensive mechanism.
Host-based artefacts like process behaviour, file system activities, API
calls, I/O request packets logs, Registry Key Operations and many more are
usually considered to monitor. To monitor network-level artefacts traffic can
get monitored when the compromised system communicates with the C&C server.
The network-level artefacts such as source and destination IP address,
protocol type, source and destination port number, the total number of bytes
per packet per conversation can be considered for analysis. In the network-
based analysis, there is an assumption that malware will communicate with
their C&C server for purposes like getting an encryption key. But this
technique may fail if malware doesn’t contact C&C servers or used any local
key. Also, malware might use proxy servers while contacting C&C servers, and
then the network-based analysis may not be feasible to detect. Researchers
focused on process anomaly detection to enhance their detection rate. The
technique discussed in the paper uses Windows API calls [21, 22, 23], I/O
request Packets (IRP) logs, File system operations, set of operations
performed per file extension, directories operations, dropped files, registry
key operation, strings [24, 25, 26, 27, 28] for detection. Researchers
recorded artefacts like folder listing, Files written, Files Renamed, files
read, write entropy, and file type coverage as file system activities [27].
The various researchers recorded IRP open, IRP write, IRP create for IRP logs
[26]. Chen et al. [29] generated API CFG (Call Flow graph) by API sequence
extracted from the API monitor tool. They converted CFG into a feature vector
for further processing.

##  3 Implementation

Our work has been carried out with a publicly available dataset prepared by
Sgandurra et al. [24]. The dataset includes 582 ransomware samples and 942
goodware samples. Dataset authors have collected good ware and ransomware
samples from various sources and used Cuckoo sandbox for analyzing them.
Goodware samples include browsers, drivers, multimedia tools, file and network
utilities, etc. Ransomware includes it’s various families tabulated in Table
1.

Table 1: Ransomware family names with correspondence ID. Family Name | ID
---|---
Goodware | 0
Critroni | 1
CryptLocker | 2
CryptoWall | 3
KOLLAH | 4
Kovter | 5
Locker | 6
MATSNU | 7
PGPCODER | 8
Reveton | 9
TeslaCrypt | 10
Trojan-Ransom | 11

This dataset consists of a total 1524 records and 30970 features [24].
Features are set of various system events and activities, and they are
identified with codes tabulated in Table 2. Feature values are in binary form,
representing whether that event occurred during ransomware and goodware
executables execution or not. If that event has occurred during execution,
then the value of that feature column is 1 for that specific sample;
otherwise, the value for that feature column is 0 for that specific sample.
Like this, we have obtained a collection of binary values as a data frame for
further analysis.

Table 2: Features ID with description. ID | Description
---|---
API | API invocations
DROP | Extensions of the dropped files
REG | Registry key operations
FILES | File operations
FILES_EXT | Extension of the files involved in file operations
DIR | File directory operations
STR | Embedded strings

Each column value of the dataset is mapped with several features shown in the
above table, such as API invocation, registry key and files operations (write,
read, create, delete), dropped file information, embedded strings, etc.

###  3.1 Feature Selection

The next we have followed is feature selection. As we had 30970 features, we
have implemented a Correlation-based Feature Selection (CFS) technique to
select relevant features from a set of features. CFS evaluates the worth of a
subset of attributes by considering each feature’s predictive ability and the
degree of redundancy between them. Subsets of features that are highly
correlated with the class while having low intercorrelation are preferred. So,
we decided to use the Mutual Information (MI) feature selection method. It is
a more robust option for correlation estimation, which measures mutual
dependence between variables. Mutual Information classification algorithm
takes target features, and features set and evaluate a MI score for each
feature in the set for the target feature. MI score shows how much that
feature is dependent on the target feature. MI relies on entropy estimation
from K-nearest neighbour’s distances. If the MI score of any feature equals
zero, the feature is independent of the target feature. So, these features are
none of our use, and we can neglect the same. If the MI score of any feature
is greater than 0, it means that the feature is dependent on the target
feature, and we can consider those features for our model. Higher the MI
score, features are more dependent on the target feature, which is a good
option. MI score resulted for our chosen dataset features are shown in Figure
2 . Next, we have used the SelectKBest feature selection technique to select a
set of top MI scored features, i.e., a set of most dependent features to
provide input to the ML models.

Figure 2: MI score evaluated for each feature space.

###  3.2 Model Implementation

After selecting relevant features, we have moved forward towards model
implementations. We have implemented various machine learning models on the
selected feature set of chosen datasets, and those ML models are Decision
Tree, Random Forest, KNN, SVM, XGBoost and Logistic Regression.

The decision tree is based on the concept of decision-making in each step. It
forms a tree-like structure with possible outcomes, including resource cost,
chance event consequences, and utility. This algorithm demonstrates that it
contains conditional control statements. We have trained our decision tree
model on our dataset. Next, we implemented ransom forest, a classification
algorithm consisting of decision trees and uses feature randomness while
building uncorrelated decision tree forest whose prediction is more accurate
than any individual decision tree. The random forest has also given better
results for our dataset. We have also implemented KNN (K-Nearest neighbour)
classification method to classify whether an executable is goodware or
ransomware. This method classifies data based on the concept of how similar
two data points are. Test data is used to make an “educated guess”, like
class, an unclassified data point should be classified. The goal of the SVM
algorithm is to create the best line or decision boundary that can segregate
n-dimensional space into classes so that we can quickly put the new data point
in the correct category in the future. This best decision boundary is called a
hyperplane. We trained our SVM model on our dataset and obtained good
precision and recall; the result section discussed the same. Next, we have
chosen XGBoost, an ensemble decision-tree-based mechanism based on a gradient
boosting framework. When we implemented our dataset on XGBoost, we obtained
the highest accuracy. At the same time, we have also implemented the same
dataset with the Logistic regression (LR) machine learning model, which is
used to allocate observation to a discrete set of classes. LR uses sigmoid
function and produce a probability value, and based on the threshold on
probability value; we used to decide in which any sample can be classified.
The hypothesis of LR tends to limit the cost function in the range of 0 to 1.

##  4 Results

As several popular ML models have been implemented in this work, we have made
a comparative analysis between these model’s efficiency. We have tested each
implemented ML model on the test dataset and compared the results on various
metrics, those are explained in detail below:

  1. 1.

_Accuracy:_ It means the fraction of predictions our model got right, i.e.,
the ratio of no of correct prediction to the total number of samples.
Comparative accuracy analysis is shown in Table 3.

$Accuracy=\frac{NumberofCorrectPrediction}{TotalnumberofPredictionMade}$ (1)

Table 3: Accuracy obtained by each model. Model Name | Accuracy
---|---
Decision Tree | 95.63
Random Forest | 96.02
KNN | 93.64
SVM | 96.42
XGBoost | 98.21
Linear Regression | 98.21
  2. 2.

_Confusion Matrix:_ It provides a matrix as output and describes the complete
performance of any ML model. For our case, we are solving binary class
classification, and we had a total of 503 samples in our test data. There are
four most relevant terms: (1) True Positive (TP) – The number of cases that
are predicted as ransomware and the actual expected output is also ransomware
only, (2) True Negative (TN) – The number of cases that are predicted as
goodware and actual expected output is also goodware, (3) False Positive (FP)
– The number of cases which are predicted as ransomware and expected output is
goodware, (4) False Negative (FN) - The number of cases which are predicted as
goodware and expected output is ransomware. The score of each of these
terminologies are shown in Table 4.

Table 4: TP, TN, FP and FN obtained by each model. Name | TP | TN | FP | FN
---|---|---|---|---
DT | 184 | 297 | 16 | 6
RF | 186 | 297 | 16 | 4
KNN | 181 | 299 | 23 | 9
SVM | 185 | 300 | 13 | 5
XGB | 188 | 306 | 7 | 2
LR | 187 | 307 | 6 | 3
  3. 3.

_Precision & Recall:_ Precision shows the number of correct positive outputs
in total positive results predicted by the classifier. Recall demonstrates no
of correct positive outputs in all samples that should have been resulted as
positive. Comparative analysis is shown in Table 5.

$Precision=\frac{TP}{TP+FP}$ (2) $Recall=\frac{TP}{TP+FN}$ (3)

Table 5: Precision and Recall obtained by each model. Name | Precision | Recall
---|---|---
DT | 0.92 | 0.97
RF | 0.92 | 0.98
KNN | 0.89 | 0.95
SVM | 0.93 | 0.97
XGB | 0.96 | 0.99
LR | 0.97 | 0.98

##  5 Conclusion & Future Works

This work aimed to design and develop an ML-based system that identifies
executables whose activity matches ransomware activities. This thesis works
upon working on well-defined behaviour, and the intention of executables are
being analyzed. This framework consists of steps: Data collection, processing
of those data, features extraction and implementation of ML model. The same
has been achieved by deploying Cuckoo Sandbox, Ransomware sample analysis and
ML model implementation using python script.

The implemented ML model can get extended to implement an ML-based detection
system sole product to detect upcoming ransomware threats for the industry.
For enterprise-level implementation, we need to monitor logs generated by the
organization’s distributed systems. We can feed the status of API calls log,
registry key operations logs, and file system operations logs to our saved
model to decide whether the activity belongs to ransomware or not.

To record these logs activities, enterprises generally use EDR (Endpoint
Detection and Response) and SIEM (Security Information and Event Management).
EDR is an endpoint security solution that combines endpoint data and real-time
continuous log monitoring with a rule-based automated response. SIEM is a
security tool, which collects data(logs) from devices, domain controllers,
networks, servers. It stores those data and applies analytics on stored data
to detect threats, discovers trends, and enables organizations to examine any
alerts. Several EDR and SIEM solutions are available in the industry, and we
can integrate this ML model with any of these solutions to detect ransomware
activities.

Also, we can use ELK (Elasticsearch Logstash Kibana) [30] to integrate our ML
model and develop a ransomware detection system as a product. ELK is an open-
source tool, and many SIEMs are built on top of ELK only. We can use ELK for
elastic search to filter and collected desired logs for our detection system.
The implemented model can get ingested the collected logs to decide on
suspicious activity based on logs details. ELK stack is a collection of three
open-source tools, i.e. Elasticsearch, Logstash, Kibana, which allow us to
store several logs to visualize them easier. Elasticsearch is a search and
analysis engine that allows us to store massive information in JSON format.
Logstash is a data processor and collector, which allows us to collect, load,
and transfer data in numerous architectures, and in the last, it can get
forwarded to Elasticsearch. Kibana provides a visualization layer to a web
browser to parse any query to Elasticsearch in several visualizations like
histograms, linear graphs, pie charts, etc. We can use ELK directly to
integrate our model with it as ELK is an open-source project.

## References

  * [1] Hobbs, A., The colonial pipeline hack: Exposing vulnerabilities in U.S. cybersecurity. In SAGE Business Cases. SAGE Publications, Ltd.,(2021)
  * [2] Sultan, H., Khalique, A., Alam, S.I, and Tanweer, S. A Survey on Ransomware: Evolution, Growth and Impact. International Journal of Advanced Research in Computer Science, 9(2) (2018).
  * [3] F. Khan, C. Ncube, L. K. Ramasamy, S. Kadry, and Y. Nam: A Digital DNA Sequencing Engine for Ransomware Detection Using Machine Learning. In: IEEE Access, vol. 8, pp. 119710 119719, (2020), 10.1109/ACCESS.2020.3003785
  * [4] S. K. Sahay et al.: A Survey on Ransomware Detection Techniques, Springer Nature Sin- gapore Pte Ltd, 2020. (eds.): SKM 2019, CCIS 1186, pp. 55-68, (2020)
  * [5] The current state of ransomware: Cryptowall. https://news.sophos.com/en-us/2015/12/17/the-current-state-of-ransomwar-cryptowall/. Last accessed 2020/11/21.
  * [6] GandCrab Ransomware. https://www.symantec.com/security-center/writeup/2018-013106-5656-99. Last accessed 2020/11/30.
  * [7] Petters J. CryptoLocker: Everything You need to know https://www.secureworks.com/research/cryptolockerransomware. Last accessed 2021/02/21.
  * [8] TeslaCrypt ransomware attack. https://www.kaspersky.co.in/resource-center/threats/teslacrypt. Last accessed 2021/08/21.
  * [9] Mohurle, S., Patil, M.: A brief study of WannaCry threat: ransomware attack 2017. Int. J. Adv. Res. Comput. Sci. 8(5), 1938–1940 (2017)
  * [10] Sason D. REvil Ransomware Attack on Kaseya VSA: What You Need to Know. https://www.varonis.com/blog/revil-msp-supply-chain-attack/. Last accessed 2021/07/30.
  * [11] Jigsaw Ransomware. https://www.pcrisk.com/removal-guides/9942-fun-ransomware . Last accessed 2016/11/21.
  * [12] Ryuk Ransomware: https://www.trendmicro.com/en_in/what-is/ransomware/ryuk-ransomware.html. Last accessed 2021/09/10.
  * [13] Petya (NotPetya): https://www.proofpoint.com/us/threat-reference/petya Last accessed 2021/04/17.
  * [14] WannaCry ransomware attack:
https://en.wikipedia.org/wiki/WannaCry_ransomware_attack#Impact. Last accessed
2021/05/21.

  * [15] Adams M. 2016: Year of the ransomware attacks. http://techgenix.com/2016-ransomware/ Last accessed 2021/01/07.
  * [16] The Anatomy of a Ransomware Attack. (2016). The Threat Research Report: https://www.exabeam.com/wp-content/uploads/2017/07/Exabeam_Ransomware_Threat_Report_Final.pdf. Last accessed 2021/02/11.
  * [17] Nachreiner C. How attackers hide their malware: Advanced Obfuscation. https://www.darkreading.com/attacks-breaches/how-hackers-hide-their-malware-advanced-obfuscation/a/d-id/1329723. last accessed 2020/10/02.
  * [18] Scaife, N., Carter, H., Traynor, P. & Butler, K.R. (2016). Cryptolock (and drop it): stop- ping ransomware attacks on user data. In 2016 IEEE 36th International Conference on Dis- tributed Computing Systems (ICDCS) (pp. 303-312).
  * [19] Kharaz, A., Arshad, S., Mulliner, C., Robertson, W., Kirda, E.: UNVEIL: a largescale, au- tomated approach to detecting ransomware. In: 25th USENIX Security Symposium (USENIX Security 2016), Austin, TX, pp. 757–772. USENIX Association (2016)
  * [20] Gomez-Hernandez, J.A., ´Alvarez-Gonzaalez, L., Garcıa-Teodoro, P.: R-Locker: thwarting ransomware action through a honeyfile-based approach. Comput. Secur. 73, 389–398 (2018)
  * [21] Al-rimy, B.A.S., Maarof, M.A., Prasetyo, Y.A., Shaid, S.Z.M., Ariffin, AFM: Zero-day aware decision fusion-based model for crypto-ransomware early detection. Int. J. Integr. Eng. 10(6), 82–88 (2018)
  * [22] D. Maiorca, F. Mercaldo, G. Giacinto, C. A. Visaggio, and F. Martinelli, “R-PackDroid: API package-based characterization and detection of mobile ransomware,” in Proceedings of the symposium on applied computing. ACM, 2017, pp. 1718–1723.
  * [23] Vigneswaran, Rahul & R, Vinayakumar & Kp, Soman & Poornachandran, Prabaharan. (2018). Evaluating Shallow and Deep Neural Networks for Network Intrusion Detection Systems in Cyber Security. 1-6. 10.1109/ICCCNT.2018.8494096.
  * [24] D. Sgandurra, L. Muñoz-González, R. Mohsen, and E. C. Lupu, “Automated dynamic analysis of ransomware: Bene_ts, limitations, and use for detection,” 2016, arXiv:1609.03020.
  * [25] Al-rimy, B.A.S., Maarof, M.A., Prasetyo, Y.A., Shaid, S.Z.M., Ariffin, AFM: Zero-day aware decision fusion-based model for crypto-ransomware early detection. Int. J. Integr. Eng. 10(6), 82–88 (2018)
  * [26] Mehnaz, S., Mudgerikar, A., Bertino, E.: RWGuard: a real-time detection system against cryptographic ransomware. In: Bailey, M., Holz, T., Stamatogiannakis, M., Ioannidis, S. (eds.) RAID 2018. LNCS, vol. 11050, pp. 114-136. Springer, Cham (2018). https://doi.org/10.1007/978-3-030-00470-5_6.
  * [27] Continella, A., et al.: ShieldFS: a self-healing, ransomware-aware filesystem. In: Proceed- ings of the 32nd Annual Conference on Computer Security Applications, ACSAC 2016, pp. 336–347. ACM, New York (2016)
  * [28] Harikrishnan, N.B., Soman, K.P.: Detecting ransomware using GURLS. In: 2018 Second International Conference on Advances in Electronics, Computers and Communications (ICAECC).
  * [29] Z.-G. Chen, H.-S. Kang, S.-N. Yin, and S.-R. Kim, “Automatic ransomware detection and analysis based on dynamic API calls flow graph,” in Proceedings of the International Con- ference on Research in Adaptive and Convergent Systems. ACM, 2017, pp. 196–201.
  * [30] R. Stoleriu, A. Puncioiu and I. Bica, ”Cyber Attacks Detection Using Open Source ELK Stack,” 2021 13th International Conference on Electronics, Computers and Artificial Intelligence (ECAI), 2021, pp. 1-6, 10.1109/ECAI52376.2021.9515120.