# Adaptive Ransomware Detection Using Similarity-Preserving Hashing
## 3 Methodology
### Custom Ransomware
However, it is still an accurate indicator of the performance, especially when taking the percentage of files saved into consideration. SPH was able to identify the running ransomware within 1.74 s at a threshold level of 7 and within approximately 10 s for the more lenient threshold of 49 at a total file size of 20 GB. The reported average encryption time for modern ransomware is 42 min and 52 s, according to [28]. However, the same research notes that the fastest ransomware variant (LockBit 3.0) can encrypt 50 GB of data within 5 min and 50 s. By comparison, our algorithm can detect ransomware within a few seconds, depending on the file size, partition size, and threshold value (Figures 7 and 8). To test the detection method in a realistic environment, we used a dataset called corpora [29]. Corpora is a dataset of 12.8K office files (including csv, pdf, docx, pptx, xlsx, txt, jpg, and more) of 11 GBs in size. The simulated ransomware takes about 14.39 s to completely encrypt the dataset. SPH detects the ransomware within 24 milliseconds. This means that detection can be done in 0.17% of the time the ransomware takes to finish its work, saving 98% of files. The results of the partition size comparison show a clear and predictable advantage to using smaller partition sizes (e.g., 10 MB and 40 MB). Let us elaborate; a smaller partition size leads to more hashes per file, and therefore, changes are detected faster, as a single file contributes multiple times to the total change counter. However, this increase comes at the cost of increased storage needed to save the extra hashes per file. This trade-off appears to be justified for smaller file sizes, especially at higher thresholds, as seen in the 5 GB sub-graph in Figure 8. Another observation is that larger file sizes tend to perform well (less corrupted files) compared to smaller ones due to the increased number of hashes, as previously mentioned. Figure 10: CPU and memory utilization for SPH with 10 MB partition size. Based on the observed results, it can be approximated that a partition size between 10 MB and 40 MB offers the most balance between detection efficiency and storage overhead. Similarly, a detection threshold between 21 and 35 would be suitable for the aforementioned reasons. Nevertheless, it must be noted that these parameters should be tuned for the given environment in which the FIM is operating, as they are impacted by many factors, including the average file size, update frequency, average change size, and risk tolerance, among other characteristics. Finally, we want to discuss the adaptive part of SPH. By adaptive, we mean that the detection method can be configured according to user preferences. There are two main parameters that the user can configure: files' partition size and threshold value. Instead of hashing complete files to detect changes in them due to ransomware, in this method, file partitions are hashed. As Figure 9 shows, smaller partition sizes allow finer scanning and detection but increase the number of partitions that have to be hashed (i.e., they increase the overhead). To distinguish between normal changes (i.e., benign changes) and malicious changes (due to ransomware), a threshold of how many file partitions have changed is set. This threshold value is also adaptive, and it can be configured by the user. As Figures 7-9 show, setting a low threshold (e.g., seven) means having stricter security requirements. An alert is issued if seven file partitions are changed in this case. Setting a low threshold value might increase the rate of false positives, as a stricter security requirement is set. On the other hand, increasing the threshold value (e.g., 49), relaxes the security requirements. This means that 49 partition changes occur before an alert is issued. This might cause the false negative rate to increase. The user can configure the partition size and the threshold value according to the nature of the environment used.