Poster: MUSTARD - Adaptive Behavioral Analysis for Ransomware Detection Davide Sanvito NEC Laboratories Europe Giuseppe Siracusano NEC Laboratories Europe Roberto Gonzalez NEC Laboratories Europe Roberto Bifulco NEC Laboratories Europe ABSTRACT Behavioural analysis based on filesystem operations is one of the most promising approaches for the detection of ransomware. Nonethe- less, tracking all the operations on all the files for all the processes can introduce a significant overhead on the monitored system. We present MUSTARD, a solution to dynamically adapt the degree of monitoring for each process based on their behaviour to achieve a reduction of monitoring resources for the benign processes. 1 INTRODUCTION Ransomware attacks are a growing source of concern [2]. Among the solutions proposed to address them [6–8], dynamic system behavioural analysis is a promising approach. Indeed, most ran- somwares access and modify many files in small time, thereby exposing a peculiar behaviour, which is detected by solutions in the state-of-the-art [3, 4, 9, 10]. These solutions apply a set of common steps: (i) collection of features by monitoring Operating System (OS) interfaces and accesses to the filesystems; (ii) analysis of the collected features to build per-process behaviors; (iii) classification of the modeled behaviors. These steps introduce a large overhead on running systems, limiting their applicability in the real world. In general, dynamic behavioural analysis methods rely on a set of features that are collected at the OS level. Often, individual fea- tures require the combination of raw counters collected at different system/OS interfaces. Furthermore, while some features are as easy as e.g., counting the number of file accesses, others include more complex operations. Therefore, the monitoring overhead depends both on the number of monitored features and on their types. For in- stance, the time to copy a 10GB file is 10% longer when just enabling the OS interfaces required for monitoring1. Adding the simple read and increment of a counter in a hash-table increases the overhead to 20%. Furthermore, some features may require significantly more compute intensive steps, e.g., computing the entropy of the written data [3–5]. In our simple file copy test, computing such complex features might increase the copy time by a factor of over 10x (from GB/s to 100MB/s of write throughput). We focus on reducing this monitoring overhead. Our idea is to investigate the opportunity to monitor only a subset of the required features at most times, enabling the collection of additional features only when a monitored process exhibits a behavior compatible to a ransomware. We build on the intuition that ransomwares perform a set of unavoidable steps: listing files; accessing many of them; reading and writing to the file; writing encrypted content. Only a relatively small number of the OS processes perform a similar set of steps, creating an opportunity to focus our monitoring on those. Therefore, we build MUSTARD2, a monitoring system that dynam- ically cascades a series of detection models, each of them using 1We run the test using Linux, ext4, and the recently introduced eBPF framework. 2Multi-Stage Adaptive Ransomware Detection Figure 1: MUSTARD workflow. CS denotes the Current Stage. features(CS) and RF(CS) denote corresponding input features and Random Forest model. an incremental number of features, in order to use few simpler features for most monitored processes, and more complex ones only for the processes that are suspected to be ransomwares. Using a popular public dataset [1], we show that MUSTARD can keep detec- tion performance, reducing monitoring overhead, at the cost of a small increase in detection latency. 2 MUSTARD We build MUSTARD, a Multi-Stage detection mechanism that uses an increasing number of features at each detection stage. For each pro- cess in the system, only few features are initially monitored, then, depending