English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Tools annual

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Presents the access of premium content as premium feature

Premium Content

Global: Zendy Plus annual

Global: Zendy Free Plan

Among many prevailing malware, crypto-ransomware poses a significant threatas it financially extorts affected users by creating denial of access viaunauthorized encryption of their documents as well as holding their documentshostage and financially extorting them. This results in millions of dollars ofannual losses worldwide. Multiple variants of ransomware are growing in numberwith capabilities of evasion from many anti-viruses and software-only malwaredetection schemes that rely on static execution signatures. In this paper, wepropose a hardware-assisted scheme, called RanStop, for early detection ofcrypto-ransomware infection in commodity processors. RanStop leverages theinformation of hardware performance counters embedded in the performancemonitoring unit in modern processors to observe micro-architectural event setsand detects known and unknown crypto-ransomware variants. In this paper, wetrain a recurrent neural network-based machine learning architecture using longshort-term memory (LSTM) model for analyzing micro-architectural events in thehardware domain when executing multiple variants of ransomware as well asbenign programs. We create timeseries to develop intrinsic statistical featuresusing the information of related HPCs and improve the detection accuracy ofRanStop and reduce noise by via LSTM and global average pooling. As an earlydetection scheme, RanStop can accurately and quickly identify ransomware within2ms from the start of the program execution by analyzing HPC informationcollected for 20 timestamps each 100us apart. This detection time is too earlyfor a ransomware to make any significant damage, if none. Moreover, validationagainst benign programs with behavioral (sub-routine-centric) similarity withthat of a crypto-ransomware shows that RanStop can detect ransomware with anaverage of 97% accuracy for fifty random trials.

RanStop: A Hardware-assisted Runtime Crypto-Ransomware Detection Technique