CryptoLock (and Drop It): Stopping Ransomware Attacks on User Data

TLDR

Ransomware encrypts users’ files and demands ransom, costing millions annually, and new variants can easily evade antivirus and intrusion detection systems. This work introduces CryptoDrop, an early‑warning detection system that alerts users during suspicious file activity. CryptoDrop uses a set of ransomware‑specific behavior indicators to halt processes tampering with large amounts of data and can be parameterized for rapid detection with low false positives. Experimental results show CryptoDrop stops ransomware execution with a median loss of only 10 files out of nearly 5,100, markedly reducing victim data loss.

Abstract

Ransomware is a growing threat that encrypts auser's files and holds the decryption key until a ransom ispaid by the victim. This type of malware is responsible fortens of millions of dollars in extortion annually. Worse still, developing new variants is trivial, facilitating the evasion of manyantivirus and intrusion detection systems. In this work, we presentCryptoDrop, an early-warning detection system that alerts a userduring suspicious file activity. Using a set of behavior indicators, CryptoDrop can halt a process that appears to be tampering witha large amount of the user's data. Furthermore, by combininga set of indicators common to ransomware, the system can beparameterized for rapid detection with low false positives. Ourexperimental analysis of CryptoDrop stops ransomware fromexecuting with a median loss of only 10 files (out of nearly5,100 available files). Our results show that careful analysis ofransomware behavior can produce an effective detection systemthat significantly mitigates the amount of victim data loss.