Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems

Android ransomware is one of the most threatening attacks that is increasing at an alarming rate. Ransomware attacks usually target Android users by either locking their devices or encrypting their data files and then requesting them to pay money to unlock the devices or recover the files back. Exis...

Descripción completa

Guardado en:

Detalles Bibliográficos
Autores principales:	Rana Almohaini, Iman Almomani, Aala AlKhayer
Formato:	article
Lenguaje:	EN
Publicado:	MDPI AG 2021
Materias:	Android ransomware hybrid analysis detection dynamic analysis static analysis Technology T Engineering (General). Civil engineering (General) TA1-2040 Biology (General) QH301-705.5 Physics QC1-999 Chemistry QD1-999
Acceso en línea:	https://doaj.org/article/600012a61c02420da1ffd3898f160db1
Etiquetas:	Agregar Etiqueta Sin Etiquetas, Sea el primero en etiquetar este registro!

id	oai:doaj.org-article:600012a61c02420da1ffd3898f160db1
record_format	dspace
spelling	oai:doaj.org-article:600012a61c02420da1ffd3898f160db12021-11-25T16:42:19ZHybrid-Based Analysis Impact on Ransomware Detection for Android Systems10.3390/app1122109762076-3417https://doaj.org/article/600012a61c02420da1ffd3898f160db12021-11-01T00:00:00Zhttps://www.mdpi.com/2076-3417/11/22/10976https://doaj.org/toc/2076-3417Android ransomware is one of the most threatening attacks that is increasing at an alarming rate. Ransomware attacks usually target Android users by either locking their devices or encrypting their data files and then requesting them to pay money to unlock the devices or recover the files back. Existing solutions for detecting ransomware mainly use static analysis. However, limited approaches apply dynamic analysis specifically for ransomware detection. Furthermore, the performance of these approaches is either poor or often fails in the presence of code obfuscation techniques or benign applications that use cryptography methods for their APIs usage. Additionally, most of them are unable to detect ransomware attacks at early stages. Therefore, this paper proposes a hybrid detection system that effectively utilizes both static and dynamic analyses to detect ransomware with high accuracy. For the static analysis, the proposed hybrid system considered more than 70 state-of-the-art antivirus engines. For the dynamic analysis, this research explored the existing dynamic tools and conducted an in-depth comparative study to find the proper tool to integrate it in detecting ransomware whenever needed. To evaluate the performance of the proposed hybrid system, we analyzed statically and dynamically over one hundred ransomware samples. These samples originated from 10 different ransomware families. The experiments’ results revealed that static analysis achieved almost half of the detection accuracy—ranging around 40–55%, compared to the dynamic analysis, which reached a 100% accuracy rate. Moreover, this research reports some of the high API classes, methods, and permissions used in these ransomware apps. Finally, some case studies are highlighted, including failed running apps and crypto-ransomware patterns.Rana AlmohainiIman AlmomaniAala AlKhayerMDPI AGarticleAndroidransomwarehybrid analysisdetectiondynamic analysisstatic analysisTechnologyTEngineering (General). Civil engineering (General)TA1-2040Biology (General)QH301-705.5PhysicsQC1-999ChemistryQD1-999ENApplied Sciences, Vol 11, Iss 10976, p 10976 (2021)
institution	DOAJ
collection	DOAJ
language	EN
topic	Android ransomware hybrid analysis detection dynamic analysis static analysis Technology T Engineering (General). Civil engineering (General) TA1-2040 Biology (General) QH301-705.5 Physics QC1-999 Chemistry QD1-999
spellingShingle	Android ransomware hybrid analysis detection dynamic analysis static analysis Technology T Engineering (General). Civil engineering (General) TA1-2040 Biology (General) QH301-705.5 Physics QC1-999 Chemistry QD1-999 Rana Almohaini Iman Almomani Aala AlKhayer Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems
description	Android ransomware is one of the most threatening attacks that is increasing at an alarming rate. Ransomware attacks usually target Android users by either locking their devices or encrypting their data files and then requesting them to pay money to unlock the devices or recover the files back. Existing solutions for detecting ransomware mainly use static analysis. However, limited approaches apply dynamic analysis specifically for ransomware detection. Furthermore, the performance of these approaches is either poor or often fails in the presence of code obfuscation techniques or benign applications that use cryptography methods for their APIs usage. Additionally, most of them are unable to detect ransomware attacks at early stages. Therefore, this paper proposes a hybrid detection system that effectively utilizes both static and dynamic analyses to detect ransomware with high accuracy. For the static analysis, the proposed hybrid system considered more than 70 state-of-the-art antivirus engines. For the dynamic analysis, this research explored the existing dynamic tools and conducted an in-depth comparative study to find the proper tool to integrate it in detecting ransomware whenever needed. To evaluate the performance of the proposed hybrid system, we analyzed statically and dynamically over one hundred ransomware samples. These samples originated from 10 different ransomware families. The experiments’ results revealed that static analysis achieved almost half of the detection accuracy—ranging around 40–55%, compared to the dynamic analysis, which reached a 100% accuracy rate. Moreover, this research reports some of the high API classes, methods, and permissions used in these ransomware apps. Finally, some case studies are highlighted, including failed running apps and crypto-ransomware patterns.
format	article
author	Rana Almohaini Iman Almomani Aala AlKhayer
author_facet	Rana Almohaini Iman Almomani Aala AlKhayer
author_sort	Rana Almohaini
title	Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems
title_short	Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems
title_full	Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems
title_fullStr	Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems
title_full_unstemmed	Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems
title_sort	hybrid-based analysis impact on ransomware detection for android systems
publisher	MDPI AG
publishDate	2021
url	https://doaj.org/article/600012a61c02420da1ffd3898f160db1
work_keys_str_mv	AT ranaalmohaini hybridbasedanalysisimpactonransomwaredetectionforandroidsystems AT imanalmomani hybridbasedanalysisimpactonransomwaredetectionforandroidsystems AT aalaalkhayer hybridbasedanalysisimpactonransomwaredetectionforandroidsystems
_version_	1718413019973681152

Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems

Ejemplares similares