About: Why Current Statistical Approaches to Ransomware Detection Fail

Not logged in : Login

(Sponging disallowed)

Facets (new session)
Description
Metadata
Settings
- Rule:
- Inverse Functional Properties:
- "Same As":

About: Why Current Statistical Approaches to Ransomware Detection Fail Goto Sponge NotDistinct Permalink

An Entity of Type : bibo:AcademicArticle, within Data Space : linkeddata.uriburner.com:28898 associated with source document(s)

Attributes	Values
type	http://eprints.org/ontology/ConferenceItemEPrint http://eprints.org/ontology/EPrint Article Academic Article
seeAlso	HTML Summary of #82960 Why Current Statistical Approaches to Ransomware Detection Fail
sameAs	Why Current Statistical Approaches to Ransomware Detection Fail
http://eprints.org/ontology/hasAccepted	Why Current Statistical Approaches to Ransomware Detection Fail (PDF)
http://eprints.org/ontology/hasDocument	Why Current Statistical Approaches to Ransomware Detection Fail (PDF) Why Current Statistical Approaches to Ransomware Detection Fail (Other) Why Current Statistical Approaches to Ransomware Detection Fail (Other) Why Current Statistical Approaches to Ransomware Detection Fail (Other) Why Current Statistical Approaches to Ransomware Detection Fail (Other) Why Current Statistical Approaches to Ransomware Detection Fail (Other)
dc:hasVersion	Why Current Statistical Approaches to Ransomware Detection Fail (PDF)
Title	Why Current Statistical Approaches to Ransomware Detection Fail
described by	https://demo.openlinksw.com/about/id/entity/https/www.cs.kent.ac.uk/people/staff/akj22/materials/CO644/export_kar_RDFN3.n3
Date	2020-11-25
Creator	Budi Arief J. Hernandez-Castro Jamie Pont
status	peer reviewed published
Publisher	Springer
abstract	The frequent use of basic statistical techniques to detect ransomware is a popular and intuitive strategy; statistical tests can be used to identify randomness, which in turn can indicate the presence of encryption and, by extension, a ransomware attack. However, common file formats such as images and compressed data can look random from the perspective of some of these tests. In this work, we investigate the current frequent use of statistical tests in the context of ransomware detection, primarily focusing on false positive rates. The main aim of our work is to show that the current over-dependence on simple statistical tests within anti-ransomware tools can cause serious issues with the reliability and consistency of ransomware detection in the form of frequent false classifications. We determined thresholds for five key statistics frequently used in detecting randomness, namely Shannon entropy, chi-square, arithmetic mean, Monte Carlo estimation for Pi and serial correlation coefficient. We obtained a large data set of 84,327 files comprising of images, compressed data and encrypted data. We then tested these thresholds (taken from a variety of previous publications in the literature where possible) against our dataset, showing that the rate of false positives is far beyond what could be considered acceptable. False positive rates were often above 50% and even above 90% on several occasions. False negative rates were also generally between 5% and 20%, numbers which are also far too high. As a direct result of these experiments, we determine that relying on these simple statistical approaches is not good enough to detect ransomware attacks consistently. We instead recommend the exploration of higher-order statistics such as skewness and kurtosis for future ransomware detection techniques.
Is Part Of	Financial Cryptography and Data Security https://kar.kent.ac.uk/id/repository
Subject	QA 76 Software, computer programming,
list of authors	https://kar.kent.ac.uk/id/eprint/82960#authors
presented at	23rd Information Security Conference
volume	12472
is topic of	https://www.cs.kent.ac.uk/people/staff/akj22/materials/CO644/export_kar_RDFN3.n3
is primary topic of	HTML Summary of #82960 Why Current Statistical Approaches to Ransomware Detection Fail

Faceted Search & Find service v1.17_git144 as of Jul 26 2024

Alternative Linked Data Documents: iSPARQL | ODE Content Formats:

RDF

ODATA

Microdata

About

OpenLink Virtuoso version 08.03.3331 as of Aug 25 2024, on Linux (x86_64-ubuntu_noble-linux-glibc2.38-64), Single-Server Edition (378 GB total memory, 16 GB memory in use)
Data on this page belongs to its respective rights holders.
Virtuoso Faceted Browser Copyright © 2009-2024 OpenLink Software