# Adaptive Ransomware Detection Using Similarity-Preserving Hashing
## 1 Introduction  
Ransomware is a type of malicious software (malware) that relies on demanding a payment from the victim (a ransom) for functionality, personal information, or data [1]. Ransomware comes in different shapes and forms; they differ in the way they enter the device and the damage they cause. However, one type of ransomware is prominent and has been on the rise recently, which is crypto-ransomware. This type of ransomware encrypts the files on the victim's device, rendering them useless without a decryption key. Following that, it prompts the victim with information regarding paying the ransom in order to obtain the decryption key and recover the files. A prime example of crypto-ransomware is the infamous WannaCry ransomware, which was launched in April 2017 [2]. The self-replicating crypto-ransomware worm capitalized on a Windows zero-day to propagate to other devices on a network [2]. The ransomware spread rapidly and resulted in billions of dollars in damages to critical infrastructures such as hospitals, all in a span of four days [2]. Thus, ransomware is a serious form of malware that must be studied extensively in order to not only detect it but also halt its malicious execution. Despite significant advances in security solutions at both the enterprise and consumer-grade levels, ransomware can still be a challenge to detect both before and during the execution of a payload [3; 4; 5]. Let us elaborate; the new generation malware utilizes different types of encryption schemes (oligomorphic and polymorphic) in order to hide malicious payloads from antivirus software [6]. Furthermore, threat actors can deploy metamorphic methods that dynamically hide the payloads through opcode (i.e., machine code) modifications that result in varying signatures, making it hard to track the malware across systems [6]. Malware detection methods can be sectioned into three main groups. First, signature-based methods rely on uniquely identifying each instance of malware by creating a unique identifier (i.e., a signature) [6; 7; 8; 9]. Commercial antivirus software comes with a database of such signatures and is updated regularly as new malware appears on the internet. The advantage of this method is the almost zero false positive rate, as each individual instance of malware is analyzed by experts before having its signature added to the database. However, one major disadvantage of this method is its inability to detect unknown malware until it has started spreading and causing damage. Second, heuristically based methods work by matching specific code patterns or structures known to be used with malicious intent [6; 7; 10; 11]. Similarly, they may perform a statistical analysis of the structure of code. While these methods are theoretically able to detect unknown malware, they rarely succeed, as they struggle against the evasion techniques mentioned above, and they also tend to generate false positives due to their nondeterministic nature [6]. Third, behavior-based methods rely on the real-time analysis of a program's execution and its activities [12; 13]. For example, they may analyze system calls, network activity, or file changes. These methods have proven more resilient than the other methods when it comes to new-generation malware [14]. The proposed method is behavior-based, not signature-based. This means it can protect against zero-day, unlike signature-based detection. The behavior that the method detects is rapid file changes (encryption). One major challenge these methods face is malware that changes its behavior when its execution is being analyzed (e.g., in a sandbox environment or a virtual machine) [14]. Similar to heuristic-based methods, behavior-based ones also tend to flag benign software as malicious. Our proposed method falls under the behavior-based malware detection techniques, as, at its core, it employs a file integrity monitor (FIM). FIM implementations try to detect any change in a file system and raise a flag if a change is captured.