# Adaptive Ransomware Detection Using Similarity-Preserving Hashing
## 3 Methodology
### Custom Ransomware
## 5 Conclusions

In summary, this paper has discussed a detection and monitoring paradigm for minimizing ransomware's impact using various methods and approaches to detecting ransomware based on different hashing techniques. We developed a modular system with components for hashing, file generation, benchmarking, graphing, ransomware emulation, and detection. Our results show that each technique has its merit; for example, the full hash algorithm correlates directly to the size hashed, regardless of the number of files. FSH shows that the execution time is purely a function of the number of files, while SPH performance is comparable with the added benefit of a better descriptive capability. These findings guide further work on the use of hashing algorithms for high-performance and low-latency ransomware detection. We recognize this research as the potential seed for a new consumer-grade ransomware detection tool that can be suitable for endpoints such as mobile phones, laptops, and even low-end server devices due to its speed and effectiveness. While our proof-of-concept implementation was written in Python, a commercial implementation of our research should be implemented using a more performant language that introduces lower memory and lower time overhead; C++, Go, and Rust are possible candidates. Other considerations include using a hybrid approach that adds ML capabilities to our detector, writing a kernel-level component responsible for terminating offending processes upon detection (our current system is discovery only), using OS-based triggers (instead of interval-based triggers) and other improvements that all fall in the optimization category, such as a dynamic component for determining and fine-tuning parameters such as the partition size and detection threshold based on the target environment. Another important aspect that cannot be neglected is testing against modern malware with ultra-rapid encryption capabilities, such as LockBit. Finally, like any anti-malware software, SPH requires the scanning of system and user files, which raises privacy issues. Data collection and misuse can be a concern, so user consent must be taken into consideration. **Author Contributions:** Conceptualization, A.A., A.E., O.S. and H.A. ; methodology, A.A., A.E., O.S. and H.A. ; software, A.E., O.S. and H.A. ; validation, A.A., A.E., O.S. and H.A. ; formal analysis, A.A., A.E., O.S. and H.A. ; investigation, A.A., A.E., O.S. and H.A. ; data curation, A.A., A.E., O.S. and H.A. ; writing--original draft preparation, A.A., A.E., O.S. and H.A. ; writing--review and editing, A.A., A.E., O.S. and H.A. ; visualization, A.E., O.S. and H.A. ; supervision, A.A.; project administration, A.A.; funding acquisition, A.A. All authors have read and agreed to the published version of the manuscript. **Funding:** The work in this paper was supported, in part, by the Open Access Program from the American University of Sharjah. **Institutional Review Board Statement:** This paper represents the opinions of the author(s) and does not mean to represent the position or opinions of the American University of Sharjah. **Informed Consent Statement:** Not applicable. **Data Availability Statement:** The original contributions presented in the study are included in the article, further inquiries can be directed to the corresponding author. **Conflicts of Interest:** The authors declare no conflicts of interest. ## Abbreviations

The following abbreviations are used in this manuscript:

Malicious software

File integrity monitor

Application programming interface

Machine learning

File-selective hashing

Similarity-preserving hashing

Similarity-digest hashing

SDHASH

Advanced encryption standard

## References

* [1] [PERSON]; [PERSON] A note on different types of ransomware attacks. _Cryptol. Eprint Arch._**2019**, _in press_. * [2] [PERSON] Case Study: WannaCry Ransomware.