# Adaptive Ransomware Detection Using Similarity-Preserving Hashing
## 3 Methodology
### Custom Ransomware
This can be attributed to basing the detection on the count of partitions that changed, not the count of files that changed for SPH. If one file changes, it counts as one is FSH; however, in SPH, it counts more than one, depending on the partition size, which means that the threshold can be reached faster. It is also noticeable that, if we choose a less conservative approach that has a higher threshold (prone to false positives), SPH still performs much better than FSH. Meanwhile, Figure 8 depicts the comparison in terms of time (in seconds) until detection, measured from the start of the ransomware execution (starting to encrypt files). This figure confirms that SPH performs better than FSH in terms of detection time. For example, for 50 files of size 100 MB each, 92% of the files (46 files) are saved within 0.75 s of scanning. #### 4.2.2 Comparing Partition Sizes and Threshold Values

Second, tests were conducted to compare the partition sizes of the SPH algorithm. Figure 9 shows the difference in the percentage of files saved across the four partition sizes. It is intuitive that smaller partition sizes have better (i.e., less) detection times. However, it should be mentioned that the partition size is correlated to the file size. If the partition size is greater than or equal to the file size, then SPH performs the same as FSH. In all test figures, the threshold value was tested. It is clear that smaller thresholds perform better in terms of the percentage of files saved and the detection speed. However, this means

Figure 8: Comparing the algorithms in terms of detection speed since infection. that more partitions have to be hashed. The partition size and the threshold value are configurable parameters that can be set by the user. Those two parameters affect the false positive rate, the false negative rate, the detection time, the percentage of time saved, and the time required to scan through the complete file list. This is elaborated in Section 4.4. ### Computational Costs

Throughout the benchmarking tests, both the CPU and memory utilization for SPH were recorded periodically to assess the impact of the detection system on the computer. Figure 10 shows the CPU and memory utilization for SPH with 10 MB throughout all file sizes. These configurations were chosen since they generate the largest number of hashes per file and, therefore, would provide a worst-case scenario for the system. Let us elaborate; the metrics were sampled at every iteration, which is a full loop through the tracked files. It can be seen that there is little to no impact on system resources, with CPU utilization being mostly constant across the run and peaking at 4.2%. As for memory utilization, the highest is 0.04% (26.17 MB). Finally, it should be noted that these metrics were recorded while the ransomware was running simultaneously to mimic a real use case for the system. Figure 9: Comparing the partition sizes in terms of the % of files saved. ### Discussion

When comparing the efficiency of both algorithms, it can be seen that SPH outperforms traditional FSH at every level. The performance gap only increases as the threshold increases. Let us elaborate; in the conducted tests, each file has multiple hashes in the case of SPH. Meanwhile, for FSH, it is exactly one hash. As a result, a single file results in multiple detected changes under SPH, making it possible to detect the ransomware earlier. Similarly, the time till detection depicts a similar story. As the threshold increases, it takes SPH less time to detect the ransomware than FSH. SPH detects rapid changes in files, which can be benign changes resulting in false positives. However, the false positive rate can be controlled by setting the appropriate threshold value and setting a timer for resetting the threshold count to zero. One point to consider is that, due to the multi-threading nature of the code and natural variations in the test environment, there is increased variability in the results.