Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems
Android ransomware is one of the most threatening attacks that is increasing at an alarming rate. Ransomware attacks usually target Android users by either locking their devices or encrypting their data files and then requesting them to pay money to unlock the devices or recover the files back. Exis...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2021-11-01
|
| Series: | Applied Sciences |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2076-3417/11/22/10976 |
| _version_ | 1797511283086458880 |
|---|---|
| author | Rana Almohaini Iman Almomani Aala AlKhayer |
| author_facet | Rana Almohaini Iman Almomani Aala AlKhayer |
| author_sort | Rana Almohaini |
| collection | DOAJ |
| description | Android ransomware is one of the most threatening attacks that is increasing at an alarming rate. Ransomware attacks usually target Android users by either locking their devices or encrypting their data files and then requesting them to pay money to unlock the devices or recover the files back. Existing solutions for detecting ransomware mainly use static analysis. However, limited approaches apply dynamic analysis specifically for ransomware detection. Furthermore, the performance of these approaches is either poor or often fails in the presence of code obfuscation techniques or benign applications that use cryptography methods for their APIs usage. Additionally, most of them are unable to detect ransomware attacks at early stages. Therefore, this paper proposes a hybrid detection system that effectively utilizes both static and dynamic analyses to detect ransomware with high accuracy. For the static analysis, the proposed hybrid system considered more than 70 state-of-the-art antivirus engines. For the dynamic analysis, this research explored the existing dynamic tools and conducted an in-depth comparative study to find the proper tool to integrate it in detecting ransomware whenever needed. To evaluate the performance of the proposed hybrid system, we analyzed statically and dynamically over one hundred ransomware samples. These samples originated from 10 different ransomware families. The experiments’ results revealed that static analysis achieved almost half of the detection accuracy—ranging around 40–55%, compared to the dynamic analysis, which reached a 100% accuracy rate. Moreover, this research reports some of the high API classes, methods, and permissions used in these ransomware apps. Finally, some case studies are highlighted, including failed running apps and crypto-ransomware patterns. |
| first_indexed | 2024-03-10T05:43:10Z |
| format | Article |
| id | doaj.art-600012a61c02420da1ffd3898f160db1 |
| institution | Directory Open Access Journal |
| issn | 2076-3417 |
| language | English |
| last_indexed | 2024-03-10T05:43:10Z |
| publishDate | 2021-11-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Applied Sciences |
| spelling | doaj.art-600012a61c02420da1ffd3898f160db12023-11-22T22:21:46ZengMDPI AGApplied Sciences2076-34172021-11-0111221097610.3390/app112210976Hybrid-Based Analysis Impact on Ransomware Detection for Android SystemsRana Almohaini0Iman Almomani1Aala AlKhayer2Security Engineering Lab, Computer Science Department, Prince Sultan University, Riyadh 11586, Saudi ArabiaSecurity Engineering Lab, Computer Science Department, Prince Sultan University, Riyadh 11586, Saudi ArabiaSecurity Engineering Lab, Computer Science Department, Prince Sultan University, Riyadh 11586, Saudi ArabiaAndroid ransomware is one of the most threatening attacks that is increasing at an alarming rate. Ransomware attacks usually target Android users by either locking their devices or encrypting their data files and then requesting them to pay money to unlock the devices or recover the files back. Existing solutions for detecting ransomware mainly use static analysis. However, limited approaches apply dynamic analysis specifically for ransomware detection. Furthermore, the performance of these approaches is either poor or often fails in the presence of code obfuscation techniques or benign applications that use cryptography methods for their APIs usage. Additionally, most of them are unable to detect ransomware attacks at early stages. Therefore, this paper proposes a hybrid detection system that effectively utilizes both static and dynamic analyses to detect ransomware with high accuracy. For the static analysis, the proposed hybrid system considered more than 70 state-of-the-art antivirus engines. For the dynamic analysis, this research explored the existing dynamic tools and conducted an in-depth comparative study to find the proper tool to integrate it in detecting ransomware whenever needed. To evaluate the performance of the proposed hybrid system, we analyzed statically and dynamically over one hundred ransomware samples. These samples originated from 10 different ransomware families. The experiments’ results revealed that static analysis achieved almost half of the detection accuracy—ranging around 40–55%, compared to the dynamic analysis, which reached a 100% accuracy rate. Moreover, this research reports some of the high API classes, methods, and permissions used in these ransomware apps. Finally, some case studies are highlighted, including failed running apps and crypto-ransomware patterns.https://www.mdpi.com/2076-3417/11/22/10976Androidransomwarehybrid analysisdetectiondynamic analysisstatic analysis |
| spellingShingle | Rana Almohaini Iman Almomani Aala AlKhayer Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems Applied Sciences Android ransomware hybrid analysis detection dynamic analysis static analysis |
| title | Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems |
| title_full | Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems |
| title_fullStr | Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems |
| title_full_unstemmed | Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems |
| title_short | Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems |
| title_sort | hybrid based analysis impact on ransomware detection for android systems |
| topic | Android ransomware hybrid analysis detection dynamic analysis static analysis |
| url | https://www.mdpi.com/2076-3417/11/22/10976 |
| work_keys_str_mv | AT ranaalmohaini hybridbasedanalysisimpactonransomwaredetectionforandroidsystems AT imanalmomani hybridbasedanalysisimpactonransomwaredetectionforandroidsystems AT aalaalkhayer hybridbasedanalysisimpactonransomwaredetectionforandroidsystems |