Scribd
Upload
2 views2 pages

04 Ransomware Detection

The document presents EntropyGuard, a behavioral ransomware detection system that monitors write-entropy dynamics and filesystem telemetry, achieving 98.6% detection accuracy with a low false-positive rate of 0.3%. It evaluates 41 ransomware families and demonstrates effective early detection, allowing for automated rollback to minimize data loss. The system operates with minimal I/O overhead, making it suitable for production environments.

Uploaded by

vageno3774
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
2 views2 pages

04 Ransomware Detection

The document presents EntropyGuard, a behavioral ransomware detection system that monitors write-entropy dynamics and filesystem telemetry, achieving 98.6% detection accuracy with a low false-positive rate of 0.3%. It evaluates 41 ransomware families and demonstrates effective early detection, allowing for automated rollback to minimize data loss. The system operates with minimal I/O overhead, making it suitable for production environments.

Uploaded by

vageno3774
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

Behavioral Detection of Ransomware Using Entropy

Dynamics and Filesystem Telemetry


Elena Petrova, James O'Connor, Ravi Menon
Cybersecurity Research Group, Demo National Lab — DEMO PAPER

Abstract
Signature-based defenses fail against novel ransomware families. We propose
EntropyGuard, a behavioral detector that monitors write-entropy dynamics, file-rename
cascades, and shadow-copy tampering in real time. Evaluated against 41 ransomware
families (including 9 held-out zero-day samples) and 120 benign workloads, EntropyGuard
achieves 98.6% detection with a 0.3% false-positive rate, flagging attacks after a median of
11 encrypted files. Kernel-level telemetry adds under 2% I/O overhead, making deployment
practical on production endpoints.

1. Introduction
Ransomware caused an estimated $30B in global damages in 2025. Static signatures lag behind
rapidly mutating families, while pure ML classifiers on binaries suffer from adversarial packing.
Behavioral detection at the filesystem layer targets the one action ransomware cannot avoid: mass
encryption of user data.

2. Detection Features
EntropyGuard computes three feature streams per process: (i) rolling Shannon entropy of write buffers,
where sustained near-8.0 bits/byte indicates encryption; (ii) rename-cascade velocity capturing
extension-change bursts; and (iii) system-event flags for shadow-copy deletion and backup-service
termination. Features are windowed at 500 ms granularity.

3. Classifier and Response


A lightweight online random forest scores each window; two consecutive scores above threshold trigger
process suspension and copy-on-write snapshot rollback. The rollback buffer retains the last 4,000
modified file versions, bounding worst-case data loss.

4. Evaluation
Across 41 families spanning crypto- and locker-type behavior, detection latency averaged 11 encrypted
files (median) and 23 (p95). Benign workloads including compression, encryption utilities, and database
checkpoints produced a 0.3% false-positive rate; whitelisting signed backup tools reduced this to
0.08%. Overhead measured 1.9% on SPECstorage-like traces.

Category Families Detection (%) Median Files Lost


Crypto (known) 27 99.2 9

Locker 5 97.1 14

Zero-day (held out) 9 97.8 16

Overall 41 98.6 11

Table 1: Detection performance by ransomware category.

5. Conclusion
Entropy dynamics combined with filesystem telemetry detect ransomware early enough for automated
rollback to bound damage. Future work addresses intermittent (partial-file) encryption strategies.

References
[1] Kharaz, A. et al. (2016). UNVEIL: A Large-Scale, Automated Approach to Detecting Ransomware. USENIX
Security.
[2] Scaife, N. et al. (2016). CryptoLock (and Drop It): Stopping Ransomware Attacks on User Data. IEEE ICDCS.
[3] Continella, A. et al. (2016). ShieldFS: A Self-healing, Ransomware-aware Filesystem. ACSAC.

This is a fictional demo paper generated for demonstration purposes only.

You might also like