Ransomware infections have grown exponentially during the recent past to cause major disruption in operations across a range of industries including the government. Through this research, we present an analysis of 14 strains of ransomware that infect Windows platforms, and we do a comparison of Windows Application Programming Interface (API) calls made through ransomware processes with baselines of normal operating system behavior. The study identifies and reports salient features of ransomware as referred through the frequencies of API calls.
Hampton et al REF furthered this work by analysing 14 strains of ransomware on Windows platforms and created mappings of the API call frequencies.
Ransomware behavioural analysis on windows platforms
J. Inf. Secur. Appl.
J. Inf. Secur. Appl.
Computer Science