勒索软件的自动化动态分析：优点、局限性和检测用途
Automated Dynamic Analysis of Ransomware: Benefits, Limitations and use for Detection
摘要：
最近的统计数据显示，2015年发现了超过1.4亿个新的恶意软件样本，其中很大一部分是勒索软件，这类恶意软件的特定目标是使受害者的系统无法使用，特别是通过加密重要文件，然后要求用户支付赎金来恢复损坏。一些勒索软件包括复杂的打包技术，因此难以进行静态分析。我们提出了EldeRan，一种用于动态分析和分类勒索软件的机器学习方法。EldeRan监控应用程序在安装的第一阶段执行的一系列操作，检查勒索软件的特征标志。我们对属于11个家族的582个勒索软件和942个好软件应用程序的数据集进行了测试，结果显示EldeRan的ROC曲线下面积为0.995。此外，EldeRan的工作不需要事先提供整个勒索软件家族。这些结果表明，动态分析可以支持勒索软件检测，因为勒索软件样本在运行时表现出一组跨家族常见的特征，这有助于早期检测新的变体。我们还概述了勒索软件动态分析的一些局限性，并提出了可能的解决方案。
英文摘要：
Recent statistics show that in 2015 more than 140 millions new malware samples have been found. Among these, a large portion is due to ransomware, the class of malware whose specific goal is to render the victim's system unusable, in particular by encrypting important files, and then ask the user to pay a ransom to revert the damage. Several ransomware include sophisticated packing techniques, and are hence difficult to statically analyse. We present EldeRan, a machine learning approach for dynamically analysing and classifying ransomware. EldeRan monitors a set of actions performed by applications in their first phases of installation checking for characteristics signs of ransomware. Our tests over a dataset of 582 ransomware belonging to 11 families, and with 942 goodware applications, show that EldeRan achieves an area under the ROC curve of 0.995. Furthermore, EldeRan works without requiring that an entire ransomware family is available beforehand. These results suggest that dynamic analysis can support ransomware detection, since ransomware samples exhibit a set of characteristic features at run-time that are common across families, and that helps the early detection of new variants. We also outline some limitations of dynamic analysis for ransomware and propose possible solutions.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
