Authors:
Nicolas Bailluet
1
;
Hélène Le Bouder
2
and
David Lubicz
3
Affiliations:
1
ENS Rennes, France
;
2
OCIF IMT Atlantique Campus Rennes, France
;
3
DGA MI, Bruz, France
Keyword(s):
Ransomware, Detection, Malware, Markov Chain, File Header.
Abstract:
In this paper, a new approach for the detection of ransomware based on the runtime analysis of their behaviour is presented. The main idea is to get samples by using a mini-filter to intercept write requests, then decide if a sample corresponds to a benign or a malicious write request. To do so, in a learning phase, statistical models of structured file headers are built using Markov chains. Then in a detection phase, a maximum likelihood test is used to decide if a sample provided by a write request is normal or malicious. We introduce new statistical distances between two Markov chains, which are variants of the Kullback-Leibler divergence, which measure the efficiency of a maximum likelihood test to distinguish between two distributions given by Markov chains. This distance and extensive experiments are used to demonstrate the relevance of our method.