Understanding and detecting next-generation ransomware

Ransomware is one of the most dangerous malware threats, as it has the potential of disrupting operations of organizations, governments, and critical infrastructure. In this project, we investigate limitations of existing ransomware detection techniques, and techniques that can make the next generation of detectors more effective. In our ACNS 2020 paper we show how multiprocess ransomware can circumvent existing detectors (our NCAA paper discusses possible countermeasures). In our NSS 2020 paper we identify limitations in existing encryption detection techniques, which are a core component of many ransomware detectors. We also show how a deep learning-based approach to the problem brings significant improvements. Collaborators: Luigi Mancini, Fabio De Gaspari (La Sapienza).