# Adaptive Ransomware Detection Using Similarity-Preserving Hashing
## 3 Methodology
### Custom Ransomware
The specifications of the machine are summarized below:

* Operating system: Windows 11 Pro, Version 10.0.22631;
* Processor: Intel 13 th-Gen i7-13700K, 5 GHz;
* RAM: 64 GB;
* Storage: 1 TB SSD. ## 4 Results

In this section, we present and discuss the results of the proposed ransomware detection methodology. ### Hashing Performance

Our detection algorithm faces a major bottleneck: the hashing algorithm. The ideal hashing algorithm should be fast, incur minimal overhead, be parallelizable, and minimize false positives, as discussed in Algorithm 1. For each of the three hashing techniques, we benchmarked performance across both total data size and the number of files. For each technique, we benchmarked eight data sizes, starting at 5 GB to 30 GB at 5 GB intervals split across 100, 400, 700, and 1000 files. We plotted the results over three trials to better understand the behavior of our hashing techniques. The results are summarized in Figures 4-6. Figure 4 shows the execution time of the full hash algorithm. Quite expectedly, full hashing directly correlates to the size hashed, regardless of the number of files. Figure 5 shows the performance of file-selective hashing. We can see that the execution time is now purely a function of the number of files, regardless of the total data size; as the number of files increases, the execution time increases, regardless of the data size. This behavior is explained in Figure 2, which shows how we only hash select portions of the file, leading to a super-efficient yet descriptive aggregate hash. Time could be further reduced if we minimized the file handling overhead or parallelized the file reads. Figure 6 shows the SPH performance, which is comparable to that of FSH seen before with the added benefit of a better descriptive capability. SPH (as visualized in Figure 3) returns a list of hashes, with each describing the state of changes in different portions of the affected file. We think this technique has the highest potential, and with more research and optimization, it can become a highly performant litmus test to stop ransomware and maximize file recovery rates. As demonstrated in Figure 6, the maximum execution time was about 1.3 s for hashing 30 GB of 500 files. Figure 4: Performance of full-hash algorithm. Figure 5: Performance of file-selective hash. Figure 6: Performance of SPH. ### SPH Performance

The system was put to the test by running the SPH alongside the custom ransomware implementation and seeing how well the SPH performed in terms of efficiency (the percentage of files saved) and speed (the time taken until detection). Furthermore, different threshold levels were chosen. The threshold represents the number of changed hashes (corrupted files). Both algorithms were tested. The test setup is summarized below:

* Fifty monitored files in total;
* Total size (distributed across the 50 files): 5 GB, 10 GB, 15 GB, and 20 GB;
* Algorithms: FSH and SPH;
* SPH partition sizes: 10 MB, 40 MB, 70 MB, and 100 MB;
* Threshold levels: 7, 21, 35, and 49;
* Each test was repeated three times for verification. Figures 7 and 8 were generated, each with four sub-plots, one for each total file size (and a proportionally increasing partition size). Furthermore, since three trials for configuration were conducted, the median absolute deviation (MAD) was calculated, and it is depicted as a black line at the top of the bars in the plot. MAD refers to taking the median of the absolute differences of the data points from the mean. This technique offers robustness to outliers over methods for measuring the spread, such as the standard deviation, especially with such small sample sizes. #### 4.2.1 Comparing Algorithms

First, the SPH algorithm is compared against selective hashing. Figure 7 illustrates the comparison of the algorithms with regard to the percentage of files saved from ransomware. The main weakness in the FSH is obvious in this figure, as SPH performs better.