# KRDroid: Ransomware-Oriented Detector for Mobile Devices Based on Behaviors
## 1 Introduction  
With the unprecedented outbreak of different kinds of ransomware in recent years, devices and files from all walks of life have been locked. It has brought economic losses to both individuals and enterprises. Ransomware have been growing from the last few years since 2017, and it has become a key threat to mobile devices [1]. There are at least 150 countries with 300,000 users are attacked by the WannaCry (a kind of ransomware) according to the statistics. It causes economic losses as high as USD 8,000,000,000. According to the new report released by Precise Security, WannaCry remains one of the most influential ransomware in 2019. In 2019, a new kind of ransomware, Silex, was found by researchers. The spread of these types of ransomware is rapid. Silex first affected 350 devices and then quickly expanded to more than 1500 devices. According to the statistics released by Coveware, the payment ransomware require in the second quarter of 2020 is four times higher than in 2019 [2]. It is reported that the number of mobile devices based on the Android platform has sharply increased [3; 4; 5; 6]. It is worth noting that the number of Android devices will be approximately 6.1 billion by the end of 2020 [7; 8; 9; 6]. At present, ransomware running on Android is still a threat to mobile devices. In this work, we mainly focus on detecting ransomware based on the Android platform for mobile devices. Ransomware detection on Windows has been relatively well established. For instance, 2 entFOX can detect highly survivable ransomware with high detection accuracy and low false-positive rate [10]. UNVEIL uses filesystem to monitor and OCR to detect locking devices and encrypting files ransomware [11]. ShieldFS [12] and reference [13] can identify ransomware by I/O request packets. EldeRan uses dynamic analysis to distinguish ransomware from goodware [14]. Some works [15; 16; 17; 18] focus on encrypting ransomware detection by using traffic characteristics or sensitive APIs. The methods of detecting ransomware on other platforms could not be directly applied on Android. On the one hand, detectors [15; 16; 17; 18] use traffic to identify ransomware. This means detected ransomware should have network access, while most ransomware on Android can ransom without network access. On the other hand, Android has its own security mechanism, meaning that there are many different files and features that can be used for Android ransomware detection. For Android, the approach for ransomware-oriented detection is incomplete. In 2016, [PERSON] et al. [19] first proposed a ransomware detector based on machine learning. To our best knowledge, HelDroid [19] and GreatEalton [20] are the earliest ransomware-oriented detectors based on static analysis with machine learning. They detect ransomware based on threatening text detectors, lock detectors, and encryption detectors. If the ransomware uses unseen language, it may cause many misjudgments. The execution time is nearly seconds per sample on average [19]. There are also some detectors that use dynamic analysis to identify ransomware. DNA-Droid [21] combines static and dynamic analysis to detect ransomware. R-PackDroid [22] is a practical on-device detector of Android ransomware. [PERSON] et al. [23] focus on files encryption ransomware in IoT and detect them by using energy consumption. If users need to detect large-scale samples by using detectors with dynamic analysis, it may be time consuming. Many ransomware detectors identify ransomware based on sensitive APIs. However, there are some ransomware that use insensitive API callings to ransom. For example, a ransomware application can make its interface be the top-level interface suspending on the screen though users press Home buttons or Back buttons. Detectors may misjudge them as goodware behaviors. Some goodware applications that have the functions of locking devices and encrypting files have behaviors similar to ransomware.