Ransomware is a rapidly evolving type of malware crafted to encrypt user files, rendering them inaccessible and demanding a ransom. The impact of ransomware attacks on both enterprises and individuals is significant. However, early detection of such malware remains a formidable challenge with current detection methods. In this paper, we propose Ranker, a real-time approach designed for early ransomware detection through kernel-level behavioral analysis. Analyzing various ransomware families, we discovered that half of these attacks exhibit stealthy behaviors preceding the actual attack. Extracting insights from the pre-attack malicious behavior proves effective for early detection of ransomware. For ransomware families that encrypt files directly, considering that interacting with user files is their goal, our focus is on monitoring file changes during the attack, hoping to detect ransomware when fewer files are lost. Therefore, Ranker systematically characterizes the kernel-level behavior of ransomware during the pre-attack and attack stages, identifying general and essential characteristics. Ranker also introduces a lightweight detector for real-time ransomware detection. Extensive experiments demonstrate that Ranker achieves an average F1 score of 99.43% in ransomware detection, with a mere 0.11% false positives across 68 distinct ransomware families. Notably, Ranker detects 95% of ransomware attacks with no more than one file encrypted and attains a 97.16% accuracy in identifying 22 previously unseen ransomware families.

中文翻译：

---

Ranker：通过内核级行为分析进行早期勒索软件检测


勒索软件是一种快速发展的恶意软件，旨在加密用户文件，使其无法访问并要求勒索赎金。勒索软件攻击对企业和个人的影响都是巨大的。然而，对于当前的检测方法来说，早期检测此类恶意软件仍然是一个巨大的挑战。在本文中，我们提出了Ranker，这是一种实时方法，旨在通过内核级行为分析进行早期勒索软件检测。通过分析各种勒索软件系列，我们发现其中一半的攻击在实际攻击之前表现出隐秘行为。从攻击前的恶意行为中提取见解对于勒索软件的早期检测非常有效。对于直接加密文件的勒索软件家族，考虑到与用户文件交互是其目标，我们的重点是监控攻击过程中的文件变化，希望在文件丢失较少的情况下检测到勒索软件。因此，Ranker系统地表征了勒索软件在攻击前和攻击阶段的内核级行为，识别出一般特征和本质特征。 Ranker 还引入了用于实时勒索软件检测的轻量级检测器。大量实验表明，Ranker 在勒索软件检测方面的平均 F1 得分为 99.43%，在 68 个不同的勒索软件家族中误报率仅为 0.11%。值得注意的是，Ranker 可以检测到 95% 的勒索软件攻击，且加密文件不超过一个，并且在识别 22 个以前未见过的勒索软件系列方面达到了 97.16% 的准确率。