An Anti-Ransomware Tool Design by Using Behavioral and Static Analysis Methods

Abstract

Ransomware, which constantly improves by updating itself and transferring to the network and computing environment, is the most common type of malware used by the attackers recently. Ransomware demands ransom from the user for decrypting the encrypted files. As a result of the payment of the desired amount of ransom, the files can be opened with the decryption key delivered to the user. Various antivirus software using static analysis methods fails to detect the malware because it performs analysis via hash signature samples in databases. Because hash signature samples of zero-day attacks are not recorded in anti-virus databases, detecting malware by using behavioral analysis methods is more effective. Anti-ransomware in the hybrid structure using static analysis methods, along with behavioral analysis methods, will be even more successful in detecting and preventing ransomware with minimum false-positive rate and minimal file loss. As a result of a comprehensive review of related literature and professional reports on ransomware, the attack vectors of the ransomware, the core features, the identification methods and the movements based on the Windows Operating Systems have been found. This study presents the behavior of the ransomware in detail and explains how should an anti-ransomware tool be created to detect and prevent ransomware on Windows Operating Systems.