Machine Learning Based Ransomware Detection

Using Storage Access Patterns Obtained From

Live-forensic Hypervisor
Manabu Hirano Ryotaro Kobayashi
Department of Information and Computer Engineering Faculty of Informatics
National Institute of Technology, Toyota College Kogakuin University
Toyota, Japan Tokyo, Japan
hirano@[Link] [Link]@[Link]

Abstract—With the rapid increase in the number of Internet of propagated itself faster than previous ransomware families
Things (IoT) devices, mobile devices, cloud services, and cyber- such as GPcode (2008) or CryptoLocker (2013) because it
physical systems, the large-scale cyber attacks on enterprises and exploits infamous MS17-101 vulnerability that affects a large
public sectors have increased. In particular, ransomware attacks
damaged UK’s National Health Service and many enterprises number of computers that enable file sharing functions of
around the world in 2017. Therefore, researchers have proposed unpatched Windows operating systems.
ransomware detection and prevention systems. However, manual Ransomware was not a new class of malware in 2017, how-
inspection in static and dynamic ransomware analysis is time- ever recent advances in cryptocurrency such as Bitcoin have
consuming and it cannot cope with the rapid increase in variants
of ransomware family. Recently, machine learning has been used enabled ransomware’s creators to charge ransom to victims
to automate ransomware analysis by creating a behavioral model without revealing their identities. Kharraz et al. showed a long-
of same ransomware family. To create effective behavioral models term study of ransomware attacks between 2006 and 2014
of ransomware, we first obtained storage access patterns of [2]. They reported that their examination on the file system
live ransomware samples and of a benign application by using activities of multiple ransomware samples suggests that it is
a live-forensic hypervisor called WaybackVisor. To distinguish
ransomware from a benign application that has similar behavior possible to detect and to prevent a significant number of zero-
to ransomware, we carefully selected five dimensional features day ransomware attacks by looking their behavior of Input and
that were extracted both from actual ransomware’s Input and Output (I/O) requests.
Output (I/O) logs and from a benign program’s I/O logs. We
In this paper, we present a novel machine learning based
created and evaluated machine learning models by using Random
Forest, Support Vector Machine, and K-Nearest Neighbors. Our ransomware detection method. This paper’s unique contribu-
experiments using the proposed five features of storage access tions are:
patterns achieved F-measure rate of 98%.
Index Terms—Machine learning, Ransomware, Dynamic anal- • Hypervisor-based I/O request collection and machine
ysis, Behavioral model, Zero-day attacks learning: the majority of previous work employ I/O mon-
itor or Application Programming Interface (API) monitor
I. I NTRODUCTION in operating system layer. These monitoring frameworks
Large-scale cyber attacks on enterprises and public sectors cannot be integrated with new operating system with-
have increased with the rapid increase in the number of Inter- out additional development. Our proposal employs a
net of Things (IoT) devices, mobile devices, cloud services, hypervisor-based I/O request collection mechanism so
and cyber-physical systems. In particular, ransomware is a that behavioral models can be created without any mod-
class of malware that locks victims computers or files until ification of an operating system or of kernel drivers.
they make a payment. Chen and Bridges presented a detailed • Behavioral model based on hardware-level I/O requests
analysis of WannaCry, a famous zero-day ransomware that of storage devices: we created a behavioral model of
damaged UK’s National Health Service (NHS) and many ransomware by using only hardware-level I/O access
enterprises around the world in 2017, by using automated be- patterns.
havioral analysis [1]. They extracted the features of WannaCry • Detailed analysis of selected five features for machine
from logs on sandbox environment. WannaCry was spread by learning: we employed the following five features: en-
using MS17-010 vulnerability known as EternalBlue. Once tropy of sectors, a total amount of read sectors, a total
WannaCry’s payload reaches a target host system, it scans amount of written sectors, variance of Logical Block
the file system starting at the desktop folder, and encrypts Address (LBA) in read requests, and variance of LBA in
files by using one AES key per file. Finally, WannaCry write requests. The each feature importance is presented
creates files such as ransom note in each directory. WannaCry with its detailed analysis.

978-1-7281-2949-5/19/$31.00 ©2019 IEEE

 II. R ELATED WORK
Ransomware
Kharraz et al. presented UNVEIL, a large-scale automated collects ransomware’s I/O requests
Operating system and sends them via network
system for ransomware detection [3]. UNVEIL includes I/O
access monitor to identify distinctive and repetitive patterns WaybackVisor
(hypervisor layer)
Hadoop cluster
of crypto-style ransomware. Their analysis mainly considered
write and delete requests. UNVEIL watches Shannon entropy Hardware
of the corresponding data buffer to detect encrypted data exports raw data as CSV file

created by ransomware. They showed the following three

type of ransomware’s file manipulation patterns: (1) read- Fig. 1. I/O request collection using WaybackVisor
ing an original file and overwriting the original file with
an encrypted file, (2) reading original file, writing a new
creators of a system.
encrypted file, and deleting the original file, and (3) reading an
To automate ransomware detection, many researchers have
original file, writing an encrypted file, and securely deleting
examined features of ransomware for machine learning mod-
an original file with the content. UNVEIL’s paper reported
els. Shaukat and Ribeiro used ransomware’s file system op-
the comparison of filesystem activity between ransomware and
erations (e.g., directory info queries, read, write, rename, and
benign applications that has ransomware-like behavior (e.g., a
delete) and Shannon entropy of written files for feature vectors
Zip compression program). Although UNVEIL’s I/O access
[6]. Homayoun et al. employed registry key operations and
monitor is deployed in operating system layer, our I/O access
file system operations for feature vectors [7]. Alhawi et al.
monitor is deployed in hypervisor layer. Thus, our proposal
employed network traffic features of ransomware for machine
does not need to modify any function of the target operating
learning [8]. Azmoodeh et al. proposed a machine learning
system. Moreover, we propose novel features such as variance
based approach to detect ransomware attacks by using power
of Logical Block Address (LBA) of accessed sectors.
consumption of Android smartphones [9].
Scaife et al. showed the following three primary indicators
of ransomware’s malicious file changes to develop their early- III. DATASET CREATION
warning system for ransomware called CryptoLock [4]: (1) Hirano et al. presented WaybackVisor, a lightweight hy-
file type changes, (2) measurement of similarity between an pervisor that supports proactive collection and preservation
original file and its encrypted file, and (3) Shannon entropy of I/O logs [10]. WaybackVisor is a extended version of
to detect files that are encrypted by ransomware. CryptoLock BitVisor [11], a thin hypervisor for enforcing I/O device
uses the union of the three indicators to distinguish between security. WaybackVisor automatically transfers all I/O logs of
ransomware and benign applications. CryptoLock provided storage devices such as Hard Disk Drive (HDD) or Solid State
new insight of ransomware’s file search algorithms [4]. For Drive (SSD), hardware-level (i.e., serial ATA command level)
example, while TeslaCrypt attacks files found by depth-first information of written sectors and read sectors with its Logical
search, CTB-Locker attacks files in ascending order by file Block Address (LBA), to a Hadoop cluster for further analysis.
size. This analysis leads a hypothesis that each ransomware In this paper, we employ WaybackVisor to collect I/O logs of
family has distinctive features on storage access patterns. live ransomware samples. Fig. 1 shows I/O request collection
Although CryptoLock presents the important indicators of mechanism using WaybackVisor. WaybackVisor intercepts all
ransomware, it did not provide deeper analysis of storage read and write requests on storage devices in hypervisor layer
access patterns. In this paper, we present detailed analysis and so that we can collect I/O logs on any operating system.
comparison of storage access patterns between ransomware WaybackVisor intercepts hardware-level I/O requests and I/O
and benign applications for the use of machine learning. responses between operating system and storage devices, not
On the other hand, we have faced a problem of the rapid in- file system API calls of operating system. Finally, we obtain
crease in malware variants generated by automated programs. I/O logs in Comma Separated Values (CSV) format.
To protect users’ systems from these automatically generated Fig. 2 shows relationship between WaybackVisor and this
malware, anti-virus vendors and researchers basically employ paper. I/O logs of two ransomware samples, WannaCry and
conventional static and dynamic malware analysis methods. TeslaCrypt, and of benign Zip application were collected
Static malware analysis is carried out by manual inspection of by using WaybackVisor. Table I shows SHA-256 values of
binary code without executing it. Dynamic malware analysis the ransomware samples. We executed these programs on
is conducted by executing malware samples in a controlled en- Windows 7 of 64 bit version. A Zip program compressed
vironment called sandbox. Both methods are time-consuming govdoc1 dataset [12], files obtained from web servers in the
and they cannot cope with the rapid increase in variants of .gov domain. The I/O logs were collected during 30 seconds
malware family. Recently, machine learning has been used to immediately after each program starts.
create a model to detect variants of same malware family in
both static and dynamic analysis [5]. If malware variants have IV. F EATURE SELECTION
same features with its family, the behavioral model will be Fig. 3 shows storage access patterns of two ransomware
used to detect zero-day malware that is unknown to users and samples, WannaCry and TeslaCrypt, and a benign Zip program
 TABLE I encrypted files with high entropy. In contrast, a benign Zip
R ANSOMWARE AND BENIGN APPLICATION SAMPLES application produced high-entropy files constantly because it
Sample SHA-256 does not need to create other low-entropy files. Thus, the
WannaCry ed01ebfbc9eb5bbea545af4d01bf5f10716618 average entropy of ransomware was lower than the average en-
40480439c6e5babe8e080e41aa tropy of a Zip application in our experiments. Our observation
TeslaCrypt 3b246faa7e4b2a8550aa619f4da893db83721aa suggests that entropy can be used to distinguish ransomware
cf62b46e5863644a5249aa87e
Zip N/A (standard program in Windows 7) from a benign application.
B. Amount of read sectors and written sectors
collects raw data extracts features uses machine learning algorithm The center column of Fig. 3 shows a total amount of
Machine
read sectors or written sectors per second. WaybackVisor first
Raw Feature collected all sectors that are written or read on storage devices.
leaning
data vectors
model Then, our feature extraction program calculated a total amount
of read sectors or written sectors in byte. Both ransomware and
WaybackVisor This paper a benign Zip program first read some data before they wrote
them back again. However, the features of ransomware and
Fig. 2. Data flow between WaybackVisor [10] and this paper of a benign program were clearly different. In the graphs of
WannaCry and TeslaCrypt, the area between the write curve
and the x axis is almost same with the area between the read
that compressed files. The behavioral model must distinguish curve and the x axis. In the graph of Zip compression, the
ransomware from other benign programs that have similar area between the write curve and the x axis is less than the
behavior to ransomware in low false positive rate (FPR). We area between the read curve and the x axis. This is because
examined further more five dimensional features to create encryption algorithm does not reduce file size but compression
effective machine learning models. algorithm reduces its file size.
A. Shannon entropy of written sectors We employ Simple Moving Average (SMA) of a total
amount of read sectors or written sectors. SMA at time t is
Shannon entropy is a metric to measure uncertainty in a calculated in:
series of bit patterns [13]. Ransomware detection systems such
T −1
as UNVEIL [3] and CryptoLock [4] employ Shannon entropy 1 ∑
because the crypto-style ransomware produces encrypted data SM A(t) = Xt+i (2)
T i=0
with high entropy both in memory and in storage. We calcu-
lated Shannon entropy of each sector, written data up to 4096 where T is SMA’s period (i.e., window size T ) in seconds.
bytes, obtained from WaybackVisor. Shannon entropy H(s) For example, we calculate 10-seconds SMA by using T =
for a written sector s is calculated in: 10. Xt+i is a total size of read sectors or written sectors at
time (t + i) (seconds). Time-series features in I/O requests are
∑
n
H(s) = − p(xi ) log2 p(xi ) (1) preserved in these SMAs.
i=1
Fig. 4 shows how to calculate features by using window
size of T seconds. Our proposed features are calculated by
where p(xi ) is a probability of a byte xi , xi is an ith byte shifting window from left to right in time-series I/O logs.
(i.e., a bit pattern of 8 bit) in the sector s, n is a size of the
sector s, typical storage device has n between 1 and 4096. C. Variance of Logical Block Address (LBA)
H(s) produces a value between 0 and 8, where 8 represents a The right column of Fig. 3 shows average variance of Logi-
perfectly even distribution of byte values, where 0 represents cal Block Address (LBA) of read requests or of write requests
a sequence of same byte values. Compressing data can store per second. Variance of accessed LBA of read requests or of
same information in fewer bits and it increases Shannon write requests at time t is calculated in:
entropy H(s). Also, encrypting data increases uncertainty (i.e.,
1 ∑
N
Shannon entropy) in its bit patterns. As described in [14],
we cannot distinguish compression and encryption by simply V ar(t) = (LBAi − LBA)2 (3)
N − 1 i=1
observing Shannon entropy. To distinguish them, we have to
know how the data were generated. In this paper, we only where LBA is the mean of LBAi during T seconds, LBAi
use the fact that both of compression and encryption increase is a Logical Block Address of a read request or of a write
Shannon entropy. request, N is the total number of requests during T seconds.
The left column of Fig. 3 shows average Shannon entropy We employ window-based feature calculation shown in Fig. 4
of written sectors per second. WannaCry and TeslaCrypt to preserve time-series characteristics in variance of LBAs.
produced entropy less than a benign Zip application. Our As shown in the right column of Fig. 3, we observed that
observation shows that ransomware generated normal files variance of LBA accessed by WannaCry and by TeslaCrypt
such as ransom note with low entropy while it generated were high. In contrast, variance of LBA accessed by Zip
 Sector entropy (WannaCry) Amount of read/write (WannaCry) Variance of LBA (WannaCry)
8 30
Write 1018 Write
7 Read Read
25

Amount of read/write per second (MB)

Entropy per second (write only) (bit)

1015
6

Variance of LBA per second

20
5 1012

4 15 109
3
10 106
2
5 103
1
0 0 100
0 5 10 15 20 25 30 0 5 10 15 20 25 30 0 5 10 15 20 25 30
seconds seconds seconds

Sector entropy (TeslaCrypt) Amount of read/write (TeslaCrypt) Variance of LBA (TeslaCrypt)

8 30
Write 1018 Write
7 Read Read
25
Amount of read/write per second (MB)
Entropy per second (write only) (bit)

1015
6

Variance of LBA per second

20
5 1012

4 15 109
3
10 106
2
5 103
1
0 0 100
0 5 10 15 20 25 30 0 5 10 15 20 25 30 0 5 10 15 20 25 30
seconds seconds seconds

Sector entropy (Zip) Amount of read/write (Zip) Variance of LBA (Zip)

8 30
Write 1018 Write
7 Read Read
25
Amount of read/write per second (MB)
Entropy per second (write only) (bit)

1015
6
Variance of LBA per second

20
5 1012

4 15 109
3
10 106
2
5 103
1
0 0 100
0 5 10 15 20 25 30 0 5 10 15 20 25 30 0 5 10 15 20 25 30
seconds seconds seconds

Fig. 3. Storage access patterns of WannaCry, TeslaCrypt, and benign Zip compression

application was low. This is because ransomware seeks files to TABLE II

be encrypted from entire file system for maximizing the effect F EATURES FOR RANSOMWARE DETECTION
of the attack. Thus, ransomware’s accesses are distributed in a # Feature name Read or write
wide range of LBAs. In contrast, typical usage of a benign Zip 1 Shannon entropy (bit) Write
program just compresses files in a same directory. Therefore, a 2 Total amount (byte) Write
Zip application’s accesses are concentrated in a narrow range 3 Variance of Logical Block Address (LBA) Write
4 Total amount (byte) Read
of LBAs. 5 Variance of Logical Block Address (LBA) Read

V. M ACHINE LEARNING AND EVALUATION

We employed five dimensional features shown in Table II. Our models were trained to classify three labels: WannaCry,
These features were standardized by removing the mean value TeslaCrypt, and Zip program shown in Table I.
of each feature and scaling to unit variance. Each machine To evaluate our model’s effectiveness, we used machine
learning model was created by using Scikit-learn version 0.20. learning performance metrics: accuracy, precision, recall, and
 TABLE III
Features are calculated in T-seconds window. Once
E VALUATION METRICS FOR DIFFERENT WINDOW SIZES IN R ANDOM
features are calculated, the window is shifted from
F OREST ( MACRO AVERAGE )
left to right. It continues until the end of logs.
Window size Accuracy Precision Recall F-measure
(seconds)
1 0.79 0.81 0.77 0.78
5 0.93 0.93 0.92 0.93
10 0.96 0.96 0.95 0.96
15 0.98 0.98 0.98 0.98
T-seconds window 20 0.98 0.98 0.97 0.98
25 0.96 0.97 0.96 0.96

Fig. 4. Window-based feature calculation

16.0%
F-measure. 28.0%
#1 Entropy (Write)
#2 Amount (Write)
TP + TN 19.0% #3 Variance of LBA (Write)
Accuracy = (4) #4 Amount (Read)
TP + TN + FP + FN #5 Variance of LBA (Read)

14.0% 23.0%
TP
P recision = (5)
TP + FP
TP
Recall = (6)
TP + FN
P recision · Recall
F -measure = 2 · (7) Fig. 5. Feature importance in Random Forest (10-seconds window)
P recision + Recall
In this paper, we employed the following performance
metrics: C. K-Nearest Neighbors
• True Positive (TP): number of samples that correctly Table V shows evaluation metrics for each window size in
classified as belonging to class K-Nearest Neighbors (KNN). The number of neighbors in the
• True Negative (TN): number of samples that correctly trained model was 5. Other hyper parameters of the model
classified as not belonging to class were default values of Scikit-learn 0.20.
• False Positive (FP): number of samples that incorrectly
VI. D ISCUSSION
classified as belonging to class
• False Negative (FN): number of samples that incorrectly
We proposed window-based feature calculation to preserve
classified as not belonging to class time-series characteristics in hardware-level (i.e., serial ATA
Stratified 5-folds cross validation and macro average were command level) storage access patterns. Three machine learn-
used in Table III, Table IV, and Table V. The number of ing models with different window size were examined. In
features were 193 (WannaCry), 310 (TeslaCrypt), and 165 the experiments, Random Forest shown in Table III and K-
(Zip) when window size was 10. Nearest Neighbors shown in Table V have better performance
than Support Vector Machine shown in Table IV. The best
A. Random Forest performance in the experiments was K-Nearest Neighbors at
We first created a machine learning model using Random window size T = 20. Both Random Forest and K-Nearest
Forest. Fig. 5 shows the feature importance in Random Forest.
Table III shows evaluation metrics for each window size in
TABLE IV
Random Forest. The number of trees in the forest was 10. The E VALUATION METRICS FOR DIFFERENT WINDOW SIZES IN S UPPORT
maximum depth of the tree was 10. Other hyper parameters V ECTOR M ACHINE ( MACRO AVERAGE )
of the trained model were default values of Scikit-learn 0.20.
Window size Accuracy Precision Recall F-measure
B. Support Vector Machine (seconds)
1 0.69 0.72 0.64 0.65
Table IV shows evaluation metrics for each window size in 5 0.80 0.86 0.76 0.79
Support Vector Machine (SVM) with radial basis function (rbf) 10 0.86 0.90 0.83 0.86
kernel. We employed one-vs-all method that fits one classifier 15 0.91 0.94 0.89 0.91
20 0.92 0.95 0.91 0.92
per class. Other hyper parameters of the trained model were 25 0.97 0.98 0.97 0.97
default values of Scikit-learn 0.20.
 TABLE V Machine, and K-Nearest Neighbors. Our experiments using the
E VALUATION METRICS FOR DIFFERENT WINDOW SIZES IN K-N EAREST five dimensional features achieved F-measure rate of 98%.
N EIGHBORS ( MACRO AVERAGE )
ACKNOWLEDGMENT
Window size Accuracy Precision Recall F-measure
(seconds) The authors thank Syunsuke Terasawa for his effort to
1 0.71 0.72 0.69 0.70 develop initial machine learning programs based on serial
5 0.88 0.88 0.87 0.87 ATA command level I/O logs. The authors thank developers
10 0.93 0.93 0.92 0.93
15 0.98 0.98 0.98 0.98
of BitVisor, the base system of our WaybackVisor. Authors
20 0.98 0.99 0.98 0.98 thank anonymous reviewers for their valuable comments.
25 0.96 0.97 0.95 0.96 This work was supported by JSPS KAKENHI Grant Number
JP17K00198.
R EFERENCES
Neighbors achieved F-measure rate of 98% at window size [1] Q. Chen and R. A. Bridges, “Automated behavioral analysis of malware:
T = 15 and T = 20. The small window size not greater A case study of wannacry ransomware,” in 2017 16th IEEE International
Conference on Machine Learning and Applications (ICMLA), Dec 2017,
than 5 seconds could not achieve F-measure rate over 93% pp. 454–460.
in all machine learning models. We tested window sizes not [2] A. Kharraz, W. Robertson, D. Balzarotti, L. Bilge, and E. Kirda, “Cutting
greater than 25 seconds. Further experiments for longer period the gordian knot: A look under the hood of ransomware attacks,” in
Detection of Intrusions and Malware, and Vulnerability Assessment,
of window size are needed. M. Almgren, V. Gulisano, and F. Maggi, Eds. Cham: Springer
We selected five dimensional features from I/O requests. International Publishing, 2015, pp. 3–24.
The feature importance of Random Forest (Fig. 5) showed that [3] A. Kharaz, S. Arshad, C. Mulliner, W. Robertson, and E. Kirda,
“UNVEIL: A large-scale, automated approach to detecting ransomware,”
the most important feature was Shannon entropy of written in 25th USENIX Security Symposium (USENIX Security 16). Austin,
sectors. In Fig. 3, although Shannon entropy of Zip program TX: USENIX Association, 2016, pp. 757–772. [Online]. Avail-
was mainly concentrated in a narrow range of entropy between able: [Link]
sessions/presentation/kharaz
7 bit and 8 bit, Shannon entropy of ransomware was distributed [4] N. Scaife, H. Carter, P. Traynor, and K. R. B. Butler, “Cryptolock (and
in a wider range of entropy between 4 bit and 7 bit. This drop it): Stopping ransomware attacks on user data,” in 2016 IEEE 36th
feature of Shannon entropy clearly distinguished ransomware International Conference on Distributed Computing Systems (ICDCS),
June 2016, pp. 303–312.
from a benign Zip program. The second and third important [5] A. Singla and E. Bertino, “How deep learning is making information
features were a total amount of written sectors and a total security more intelligent,” IEEE Security Privacy, vol. 17, no. 3, pp.
amount of read sectors. Compression of a Zip program and 56–65, May 2019.
[6] S. K. Shaukat and V. J. Ribeiro, “Ransomwall: A layered defense system
encryption of ransomware had the different ratio between a against cryptographic ransomware attacks using machine learning,” in
total amount of written sectors and a total amount of read 2018 10th International Conference on Communication Systems Net-
sectors. The fourth and fifth important features were variance works (COMSNETS), Jan 2018, pp. 356–363.
[7] S. Homayoun, A. Dehghantanha, M. Ahmadzadeh, S. Hashemi, and
of read requests and variance of write requests. Although R. Khayami, “Know abnormal, find evil: Frequent pattern mining for
typical ransomware seeks target files in an entire file system to ransomware threat hunting and intelligence,” IEEE Transactions on
maximize the effect of the attack, typical uses of a Zip program Emerging Topics in Computing, pp. 1–1, 2019.
[8] O. M. K. Alhawi, J. Baldwin, and A. Dehghantanha, Leveraging
process files in a same directory. Therefore the variance Machine Learning Techniques for Windows Ransomware Network Traffic
of LBA of a Zip program is lower than ransomware. We Detection. Cham: Springer International Publishing, 2018, pp. 93–106.
confirmed the proposed five dimensional features are effective [9] A. Azmoodeh, A. Dehghantanha, M. Conti, and K.-K. R. Choo, “De-
tecting crypto-ransomware in iot networks based on energy consumption
by evaluating our three machine learning models. footprint,” Journal of Ambient Intelligence and Humanized Computing,
vol. 9, no. 4, pp. 1141–1152, 2018.
[10] M. Hirano, T. Tsuzuki, S. Ikeda, N. Taka, K. Fujiwara, and
VII. C ONCLUSION R. Kobayashi, “Waybackvisor: Hypervisor-based scalable live forensic
architecture for timeline analysis,” in Security, Privacy, and Anonymity in
With the rapid increase in the number of Internet of Things Computation, Communication, and Storage, G. Wang, M. Atiquzzaman,
(IoT) devices, mobile devices, cloud services, and cyber- Z. Yan, and K.-K. R. Choo, Eds. Cham: Springer International
Publishing, 2017, pp. 219–230.
physical systems, the large-scale cyber attacks on enterprises [11] T. Shinagawa, H. Eiraku, K. Tanimoto, K. Omote, S. Hasegawa,
and public sectors have increased. Manual inspection of mal- T. Horie, M. Hirano, K. Kourai, Y. Oyama, E. Kawai et al., “Bitvisor:
ware samples is time-consuming and it cannot cope with the a thin hypervisor for enforcing i/o device security,” in Proceedings of
the 2009 ACM SIGPLAN/SIGOPS international conference on Virtual
rapid increase in variants of ransomware family. Machine execution environments. ACM, 2009, pp. 121–130.
learning is used to create a behavioral model of the same [12] S. Garfinkel, P. Farrell, V. Roussev, and G. Dinolt, “Bringing
ransomware family. This paper examined features that are science to digital forensics with standardized forensic corpora,”
Digital Investigation, vol. 6, pp. S2 – S11, 2009, the Proceedings
extracted from storage access patterns obtained from a live- of the Ninth Annual DFRWS Conference. [Online]. Available:
forensic hypervisor called WaybackVisor. To distinguish ran- [Link]
somware from benign applications that have similar behavior [13] C. E. Shannon, “A mathematical theory of communication,” The Bell
System Technical Journal, vol. 27, no. 3, pp. 379–423, July 1948.
to ransomware, we selected five dimensional features that are [14] R. Lyda and J. Hamrock, “Using entropy analysis to find encrypted and
extracted from hardware-level I/O logs. We created the three packed malware,” IEEE Security Privacy, vol. 5, no. 2, pp. 40–45, March
machine learning models of Random Forest, Support Vector 2007.