UNVEIL: a large-scale, automated approach to detecting ransomware

TLDR

Ransomware, a malware type that locks or encrypts user files, has resurged in recent years with high‑profile attacks such as Sony’s, prompting renewed concern. The study aims to develop a detection system that specifically targets ransomware, a gap left by generic malware detectors. UNVEIL is a dynamic analysis platform that creates an artificial user environment and monitors file or desktop interactions to identify ransomware activity. Evaluation demonstrates that UNVEIL outperforms existing methods, detecting previously unknown evasive ransomware missed by commercial antimalware.

Abstract

Although the concept of ransomware is not new (i.e., such attacks date back at least as far as the 1980s), this type of malware has recently experienced a resurgence in popularity. In fact, in the last few years, a number of high-profile ransomware attacks were reported, such as the large-scale attack against Sony that prompted the company to delay the release of the film Interview. Ransomware typically operates by locking the desktop of the victim to render the system inaccessible to the user, or by encrypting, overwriting, or deleting the user's files. However, while many generic malware detection systems have been proposed, none of these systems have attempted to specifically address the ransomware detection problem. In this paper, we present a novel dynamic analysis system called UNVEIL that is specifically designed to detect ransomware. The key insight of the analysis is that in order to mount a successful attack, ransomware must tamper with a user's files or desktop. UNVEIL automatically generates an artificial user environment, and detects when ransomware interacts with user data. In parallel, the approach tracks changes to the system's desktop that indicate ransomware-like behavior. Our evaluation shows that UNVEIL significantly improves the state of the art, and is able to identify previously unknown evasive ransomware that was not detected by the antimalware industry.