A Multi-Layer Defense Against Cryptographic Attacks: RANSOMWALL The Use of Machine Learning in Malware Attacks

Abstract

Finance, insurance, banking, real estate, medical, and public administration have been attacked. Scareware, an early form of Ransomware, tricks victims into believing their systems are infected with many viruses, spyware, and security issues. The victim buys a fake antivirus product and pays a ransom to remove infections. Awareness and better security software have greatly reduced this malware's threat. Locker ransomware like Reveton locks the user interface to block access to computing resources. It demands ransom using social engineering. Security vendors offer effective tools to restore the blocked user interface for most variants. Cryptographic Ransomware targets user data with family-specific extensions. Encrypting files with advanced algorithms prevents user data access. The user receives a ransom note threatening to delete hostage files permanently if payment is not made. Bitcoin ransom is demanded. To maintain operation, system files are not encrypted. The decryption key to restore encrypted files is not guaranteed after payment. Modern Cryptographic Ransomware uses symmetric (AES, Triple DES) and asymmetric (RSA, ECC) key cryptographic algorithms for encryption. Symmetric Keys generated by the victim encrypt user files.