Convolutional Neural Network-Based Cryptography Ransomware Detection for Low-End Embedded Processors
A crypto-ransomware has the process to encrypt victim’s files. Afterward, the crypto-ransomware requests a ransom for the password of encrypted files to victims. In this paper, we present a novel approach to prevent crypto-ransomware by detecting block cipher algorithms for Internet of Things (IoT)...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2021-03-01
|
| Series: | Mathematics |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2227-7390/9/7/705 |
| _version_ | 1797540176092725248 |
|---|---|
| author | Hyunji Kim Jaehoon Park Hyeokdong Kwon Kyoungbae Jang Hwajeong Seo |
| author_facet | Hyunji Kim Jaehoon Park Hyeokdong Kwon Kyoungbae Jang Hwajeong Seo |
| author_sort | Hyunji Kim |
| collection | DOAJ |
| description | A crypto-ransomware has the process to encrypt victim’s files. Afterward, the crypto-ransomware requests a ransom for the password of encrypted files to victims. In this paper, we present a novel approach to prevent crypto-ransomware by detecting block cipher algorithms for Internet of Things (IoT) platforms. We extract the sequence and frequency characteristics from the opcode of binary files for the 8-bit Alf and Vegard’s RISC (AVR) processor microcontroller. In other words, the late fusion method is used to extract two features from one source data, learn through each network, and integrate them. We classify the crypto-ransomware virus or harmless software through the proposed method. The general software from AVR packages and block cipher implementations written in C language from lightweight block cipher library (i.e., Fair Evaluation of Lightweight Cryptographic Systems (FELICS)) are trained through the deep learning network and evaluated. The general software and block cipher algorithms are successfully classified by training functions in binary files. Furthermore, we detect binary codes that encrypt a file using block ciphers. The detection rate is evaluated in terms of F-measure, which is the harmonic mean of precision and recall. The proposed method not only achieved 97% detection success rate for crypto-ransomware but also achieved 80% success rate in classification for each lightweight cryptographic algorithm and benign firmware. In addition, the success rate in classification for Substitution-Permutation-Network (SPN) structure, Addition-Rotation-eXclusive-or structures (ARX) structure, and benign firmware is 95%. |
| first_indexed | 2024-03-10T12:56:20Z |
| format | Article |
| id | doaj.art-9e41956a8e704f89b8db84a9eb921232 |
| institution | Directory Open Access Journal |
| issn | 2227-7390 |
| language | English |
| last_indexed | 2024-03-10T12:56:20Z |
| publishDate | 2021-03-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Mathematics |
| spelling | doaj.art-9e41956a8e704f89b8db84a9eb9212322023-11-21T11:52:45ZengMDPI AGMathematics2227-73902021-03-019770510.3390/math9070705Convolutional Neural Network-Based Cryptography Ransomware Detection for Low-End Embedded ProcessorsHyunji Kim0Jaehoon Park1Hyeokdong Kwon2Kyoungbae Jang3Hwajeong Seo4Division of IT Convergence Engineering, Hansung University, Seoul 02876, KoreaDivision of IT Convergence Engineering, Hansung University, Seoul 02876, KoreaDivision of IT Convergence Engineering, Hansung University, Seoul 02876, KoreaDivision of IT Convergence Engineering, Hansung University, Seoul 02876, KoreaDivision of IT Convergence Engineering, Hansung University, Seoul 02876, KoreaA crypto-ransomware has the process to encrypt victim’s files. Afterward, the crypto-ransomware requests a ransom for the password of encrypted files to victims. In this paper, we present a novel approach to prevent crypto-ransomware by detecting block cipher algorithms for Internet of Things (IoT) platforms. We extract the sequence and frequency characteristics from the opcode of binary files for the 8-bit Alf and Vegard’s RISC (AVR) processor microcontroller. In other words, the late fusion method is used to extract two features from one source data, learn through each network, and integrate them. We classify the crypto-ransomware virus or harmless software through the proposed method. The general software from AVR packages and block cipher implementations written in C language from lightweight block cipher library (i.e., Fair Evaluation of Lightweight Cryptographic Systems (FELICS)) are trained through the deep learning network and evaluated. The general software and block cipher algorithms are successfully classified by training functions in binary files. Furthermore, we detect binary codes that encrypt a file using block ciphers. The detection rate is evaluated in terms of F-measure, which is the harmonic mean of precision and recall. The proposed method not only achieved 97% detection success rate for crypto-ransomware but also achieved 80% success rate in classification for each lightweight cryptographic algorithm and benign firmware. In addition, the success rate in classification for Substitution-Permutation-Network (SPN) structure, Addition-Rotation-eXclusive-or structures (ARX) structure, and benign firmware is 95%.https://www.mdpi.com/2227-7390/9/7/705deep learningcryptographyransomwareinternet of things |
| spellingShingle | Hyunji Kim Jaehoon Park Hyeokdong Kwon Kyoungbae Jang Hwajeong Seo Convolutional Neural Network-Based Cryptography Ransomware Detection for Low-End Embedded Processors Mathematics deep learning cryptography ransomware internet of things |
| title | Convolutional Neural Network-Based Cryptography Ransomware Detection for Low-End Embedded Processors |
| title_full | Convolutional Neural Network-Based Cryptography Ransomware Detection for Low-End Embedded Processors |
| title_fullStr | Convolutional Neural Network-Based Cryptography Ransomware Detection for Low-End Embedded Processors |
| title_full_unstemmed | Convolutional Neural Network-Based Cryptography Ransomware Detection for Low-End Embedded Processors |
| title_short | Convolutional Neural Network-Based Cryptography Ransomware Detection for Low-End Embedded Processors |
| title_sort | convolutional neural network based cryptography ransomware detection for low end embedded processors |
| topic | deep learning cryptography ransomware internet of things |
| url | https://www.mdpi.com/2227-7390/9/7/705 |
| work_keys_str_mv | AT hyunjikim convolutionalneuralnetworkbasedcryptographyransomwaredetectionforlowendembeddedprocessors AT jaehoonpark convolutionalneuralnetworkbasedcryptographyransomwaredetectionforlowendembeddedprocessors AT hyeokdongkwon convolutionalneuralnetworkbasedcryptographyransomwaredetectionforlowendembeddedprocessors AT kyoungbaejang convolutionalneuralnetworkbasedcryptographyransomwaredetectionforlowendembeddedprocessors AT hwajeongseo convolutionalneuralnetworkbasedcryptographyransomwaredetectionforlowendembeddedprocessors |