Defenses Against Emerging Malware Threats
Creators: name: Lachtar, Nada
Publisher: name: My University
Year: 2024
Subjects: subject: Cybersecurity
subject: Malware
subject: Ransomware
subject: Cryptojacking
subject: System Defense
subject: Optimization
subject: Computer Science
subject: Computer and Information Science

description: The popularity of cryptocurrencies has garnered interest from cybercriminals, spurring an onslaught of cryptojacking campaigns that aim to hijack computational resources for the purpose of mining cryptocurrencies. We present a cross-stack cryptojacking defense system that spans the hardware and OS layers. Unlike prior work that is confined to detecting cryptojacking behavior within web browsers, our solution is application agnostic. We demonstrate that our solution is resilient to multi-threaded and throttling evasion techniques that are commonly employed by cryptojacking malware. We characterize the robustness of our solution by extensively testing a diverse set of workloads that include real consumer applications. Finally, an evaluation of our proof-of-concept implementation shows minimal performance impact while running a mix of benchmark applications. This misuse of technology is also evident in ransomware attacks, where cybercriminals exploit encryption - an essential tool for data protection - to extort money by locking data and demanding a ransom for the decryption keys. These attacks have already caused over $40 billion in damages and are projected to cost up to $250 billion by 2031. Recent research efforts have thus been directed towards developing sophisticated detection, prevention, and recovery solutions that enable victims to thwart attacks and recover data without paying ransoms. The threat of ransomware extends beyond organizations to individual consumers, particularly with the exponential growth in mobile system usage. In this context, our work concentrates on advancing the detection of mobile-based ransomware and propose a recovery mechanisms for computer systems. Traditional research on mobile malware detection has focused on approaches that rely on analyzing bytecode for uncovering malicious apps. However, cybercriminals can bypass such methods by embedding malware directly in native machine code, making traditional methods inadequate. To address these concerns, we present RansomShield, an energy efficient solution that leverages CNNs to detect ransomware. We evaluate CNN architectures that have been known to perform well on computer vision tasks and examine their suitability for ransomware detection. We show that systematically converting native instructions from Android apps into images using space-filling curve visualization techniques enable CNNs to reliably detect ransomware with high accuracy. We characterize the robustness of this approach across ARM and x86 architectures and demonstrate the effectiveness of this solution across heterogeneous platforms including smartphones and chromebooks. We evaluate the suitability of different models for mobile systems by comparing their energy demands using different platforms. Finally, we evaluate the robustness of this solution against adversarial machine learningattacks using state-of-the-art Android malware dataset. Moreover, we introduce the Real-Time Guardian, an innovative approach that monitors the randomness level of data during its transfer to storage devices. This system is designed to leverage the firmware system and trigger an interrupt in response to high randomness levels that indicate encryption activity. Subsequently, it initiates a memory search for potential encryption keys, which are then securely stored in a key vault for post-attack recovery. We have validated the effectiveness of this approach by testing it against 24 ransomware families, demonstrating its capability to retrieve encryption keys andeffectively recover encrypted files. Additionally, we explore optimization techniques that leverage the systemâs Page Table and implement a Least Recently Used (LRU) based cache system to track the least accessed addresses in memory. Our evaluations of this proof-of-concept reveal that it incurs less than 2% performance overhead when tested with PARSEC and SPLASH, and less than 5% overhead with I/O-based benchmarks.