RansomFisher: Behavior-based ransomware detection without decoys

Abstract

Ransomware remains a significant cyber threat for legacy and recent systems. This study revisits behavior-based detection and introduces RansomFisher, a novel decoyless ransomware detection system that monitors file access patterns. RansomFisher defines four features to characterize process behaviors and distinguish ransomware from benign applications: write ratio, bulk ratio, write count ratio, and continuous write count. RansomFisher was evaluated on eight recent ransomware samples and 96 benign processes, including four applications that exhibit ransomware-like behavior and 92 system services. RansomFisher detected ransomware with an average file loss of only 15.3 files before detection and a negligible average overhead of 3.7%.