Differential Area Analysis for Ransomware Attack Detection within Mixed File Datasets

TL;DR

This paper introduces a novel method for detecting ransomware by analyzing the differential area between entropy curves of files and random data, effectively distinguishing encrypted files from other high entropy files.

Contribution

The paper presents a new differential area analysis technique that improves ransomware detection accuracy by leveraging entropy curve comparisons.

Findings

The entropy characteristic of encrypted file headers can differentiate encrypted files from other high entropy files.

The differential area method correlates entropy curves with high confidence to identify encrypted data.

The approach enhances detection of ransomware-related encrypted files in mixed datasets.

Abstract

The threat from ransomware continues to grow both in the number of affected victims as well as the cost incurred by the people and organisations impacted in a successful attack. In the majority of cases, once a victim has been attacked there remain only two courses of action open to them; either pay the ransom or lose their data. One common behaviour shared between all crypto ransomware strains is that at some point during their execution they will attempt to encrypt the users' files. Previous research Penrose et al. (2013); Zhao et al. (2011) has highlighted the difficulty in differentiating between compressed and encrypted files using Shannon entropy as both file types exhibit similar values. One of the experiments described in this paper shows a unique characteristic for the Shannon entropy of encrypted file header fragments. This characteristic was used to differentiate between encrypted files and other high entropy files such as archives. This discovery was leveraged in the development of a file classification model that used the differential area between the entropy curve of a file under analysis and one generated from random data. When comparing the entropy plot values of a file under analysis against one generated by a file containing purely random numbers, the greater the correlation of the plots is, the higher the confidence that the file under analysis contains encrypted data.