RAPPER: Ransomware Prevention via Performance Counters

TL;DR

RAPPER is an unsupervised, two-step ransomware detection framework that leverages performance counters, neural networks, and Fourier analysis to detect ransomware activity accurately and efficiently with minimal data.

Contribution

It introduces a novel two-step detection method combining neural networks and Fourier analysis for ransomware detection using minimal traces.

Findings

High detection accuracy achieved

Fast and reliable detection process

Minimal trace points required for detection

Abstract

Ransomware can produce direct and controllable economic loss, which makes it one of the most prominent threats in cyber security. As per the latest statistics, more than half of malwares reported in Q1 of 2017 are ransomware and there is a potent threat of a novice cybercriminals accessing rasomware-as-a-service. The concept of public-key based data kidnapping and subsequent extortion was introduced in 1996. Since then, variants of ransomware emerged with different cryptosystems and larger key sizes though, the underlying techniques remained same. Though there are works in literature which proposes a generic framework to detect the crypto ransomwares, we present a two step unsupervised detection tool which when suspects a process activity to be malicious, issues an alarm for further analysis to be carried in the second step and detects it with minimal traces. The two step detection framework- RAPPER uses Artificial Neural Network and Fast Fourier Transformation to develop a highly accurate, fast and reliable solution to ransomware detection using minimal trace points.