# Adaptive Ransomware Detection Using Similarity-Preserving Hashing
## 3 Methodology
### Custom Ransomware  
In order to test the performance of the detection algorithm, a custom ransomware implementation was created to emulate a real ransomware attack as closely as possible. Real-world ransomware usually relies on symmetric encryption techniques like the advanced encryption standard (AES) to encrypt user data. Other instances of real-world ransomware have used asymmetric keys for encryption or a combination of symmetric and asymmetric keys, like AES and RSA [27]. Nonetheless, encrypting the same files using symmetric encryption is faster than asymmetric encryption. This is why we used AES, which is a symmetric encryption algorithm and which is practically used in many real-world ransomware scenarios [27]. The ransomware is able to encrypt files in-place by processing them in chunks of a specified size. It uses AES in Counter (CTR) mode with a 256-bit key. First, a 16-byte initialization vector (IV) is randomly generated and prepended to the file. Following that, fixed-size chunks are read from the file, encrypted, and then placed back in the same location. This is repeated until all chunks of the file are encrypted. The in-place encryption allows for faster encryption, which closely mimics real ransomware. The Encrypt File method is described in Algorithm 2. ```
1:File path \(file\_path\), Encryption key \(key\), Chunk size \(chunk\_size\)
2:File at \(file\_path\) is encrypted in-place
3:Initialize AES cipher in CTR mode with \(key\)
4:Generate random 16-byte initialization vector \(iv\)
5:Open \(file\_path\) in read-write binary mode
6:Write \(iv\) to the beginning of the file
7:Set file size \(file\_size\) to current file size
8:for\(chunk\_start=0\) to \(file\_size\) step \(chunk\_size\)do
9:Seek to \(chunk\_start\) in file
10:Read chunk of size \(chunk\_size\) from file
11:if chunk is empty then
12:break
13:end if
14:Encrypt the chunk using AES-CTR
15:Seek back to \(chunk\_start\) in file
16:Write encrypted chunk to file
17:endfor
18:Close file
```  
**Algorithm 2** Encrypt File  
```
1:File path \(file\_path\), Encryption key \(key\), Chunk size \(chunk\_size\)
2:File at \(file\_path\) is encrypted in-place
3:Initialize AES cipher in CTR mode with \(key\)
4:Generate random 16-byte initialization vector \(iv\)
5:Open \(file\_path\) in read-write binary mode
6:Write \(iv\) to the beginning of the file
7:Set file size \(file\_size\) to current file size
8:for\(chunk\_start=0\) to \(file\_size\) step \(chunk\_size\)do
9:Seek to \(chunk\_start\) in file
10:Read chunk of size \(chunk\_size\) from file
11:if chunk is empty then
12:break
13:endif
14:endif
15:Encrypt the chunk using AES-CTR
16:Seek back to \(chunk\_start\) in file
17:Write encrypted chunk to file
18:endfor
19:Close file
```  
**Algorithm 3** Encrypt File  
```
1:File path \(file\_path\), Encryption key \(key\), Chunk size \(chunk\_size\)
2:File at \(file\_path\) is encrypted in-place
3:Initialize AES cipher in CTR mode with \(key\)
4:Generate random 16-byte initialization vector \(iv\)
5:Open \(file\_path\) in read-write binary mode
6:Write \(iv\) to the beginning of the file
7:Set file size \(file\_size\) to current file size
8:for\(chunk\_start=0\) to \(file\_size\) step \(chunk\_size\)do
9:Seek to \(chunk\_start\) in file
20:Read chunk of size \(chunk\_size\) from file
21:if chunk is empty then



Furthermore, ransomware can encrypt a directory by iterating over all files and sub-directories recursively and calling the encrypt file method described above. The specification of the Encrypt Directory algorithm is shown in Algorithm 3. ```
0: Directory path \(dir\)
0: All files within \(dir\) and its subdirectories are encrypted
1: Traverse all files and subdirectories in \(dir\)
2:for each file in directory do
3: Call Encrypt File for each file
4:endfor
```

**Algorithm 3** Encrypt Directory

### Test Bench Setup

All benchmarks were run on the same test bench.