UNVEIL: a large-scale, automated approach to detecting ransomware

摘要: Although the concept of ransomware is not new (i.e., such attacks date back at least as far 1980s), this type malware has recently experienced a resurgence in popularity. In fact, last few years, number high-profile were reported, large-scale attack against Sony that prompted company to delay release film "The Interview." Ransomware typically operates by locking desktop victim render system inaccessible user, or encrypting, overwriting, deleting user's files. However, while many generic detection systems have been proposed, none these attempted specifically address problem. In paper, we present novel dynamic analysis called UNVEIL designed detect ransomware. The key insight order mount successful attack, must tamper with files desktop. automatically generates an artificial user environment, and detects when interacts data. parallel, approach tracks changes system's indicate ransomware-like behavior. Our evaluation shows significantly improves state art, able identify previously unknown evasive was detected antimalware industry.