The Effective Ransomware Prevention Technique Using Process Monitoring on Android Platform

TLDR

Recent ransomware attacks increasingly encrypt users’ files, and existing antivirus systems fail to detect new patterns. The study aims to develop a more effective method to prevent modified ransomware on Android. By intensively monitoring process CPU, memory, and I/O statistics, the proposed system flags abnormal behavior, halts suspicious processes, confirms deletion with the user, and logs confirmed cases in a database. The technique detects ransomware without relying on patterns, achieves rapid detection by integrating into Android source code, and effectively protects against modified variants with minimal damage.

Abstract

Due to recent indiscriminate attacks of ransomware, damage cases including encryption of users’ important files are constantly increasing. The existing vaccine systems are vulnerable to attacks of new pattern ransomware because they can only detect the ransomware of existing patterns. More effective technique is required to prevent modified ransomware. In this paper, an effective method is proposed to prevent the attacks of modified ransomware on Android platform. The proposed technique specifies and intensively monitors processes and specific file directories using statistical methods based on Processor usage, Memory usage, and I/O rates so that the process with abnormal behaviors can be detected. If the process running a suspicious ransomware is detected, the proposed system will stop the process and take steps to confirm the deletion of programs associated with the process from users. The information of suspected and exceptional processes confirmed by users is stored in a database. The proposed technique can detect ransomware even if you do not save its patterns. Its speed of detection is very fast because it can be implemented in Android source code instead of mobile application. In addition, it can effectively determine modified patterns of ransomware and provide protection with minimum damage.