Cluster : Mobile Device Security
Problem Statement title : Ransomware Early Warning System for Android Devices
Description:
Ransomware on mobile devices is an emerging threat where malicious apps encrypt user files
or lock the screen until a ransom is paid. While ransomware is more common on desktops,
attackers are increasingly targeting Android smartphones, given their use for digital payments,
banking, and sensitive data storage. This problem statement focuses on designing an early
warning system that can detect ransomware-like activity on Android devices before significant
damage occurs. The system should use behaviour-based detection (e.g., monitoring abnormal
file access, rapid encryption attempts, or lock-screen hijacking) and alert the user in real-time,
while ensuring minimal resource usage.
Exact Deliverables :
- A behaviour-based detection framework that monitors suspicious activities (file encryption
patterns, lock-screen abuse, rapid file renaming).
- A real-time alerting module for users when potential ransomware activity is detected.
- Prototype Android app demonstrating ransomware detection and basic recovery mechanisms
(e.g., rollback of modified files or warning before system-level locks).
- Evaluation of detection accuracy and runtime performance on test datasets.
Milestones, Evolution Parameters:
- - Phase 1: Develop baseline behaviour-based detection model (monitoring abnormal file and
lock-screen actions).
- Phase 2: Integrate the detection into an Android app with real-time alerts.
- Phase 3: Add recovery/mitigation features such as file rollback or early warnings before data
loss.
- Phase 4: Test against ransomware datasets and optimize for mobile performance.
Additional Information:
- Students should emphasize lightweight detection that runs smoothly on mobile hardware.
- Ethical testing is required: ransomware samples must be analyzed only in controlled
lab/sandbox environments.
- Consider modularity so that the system can later extend to IoT devices or other mobile
operating systems.