SLIDE 1
Redemption: Real-Time Protection Against Ransomware at End-Hosts
WRITTEN BY: PRESENTED BY: AMIN KHARRAZ NICHOLAS BURTON ENGIN KIRDA
Redemption: Real-Time Protection Against Ransomware at End-Hosts - - PowerPoint PPT Presentation
Redemption: Real-Time Protection Against Ransomware at End-Hosts - - PowerPoint PPT Presentation
Redemption: Real-Time Protection Against Ransomware at End-Hosts WRITTEN BY: PRESENTED BY: AMIN KHARRAZ NICHOLAS BURTON ENGIN KIRDA What is Ransomware? What is Ransomware? u Ransomware is malicious software that encrypts user data, and
SLIDE 2
SLIDE 3
What is Ransomware?
u Ransomware is malicious software that encrypts
user data, and demands a ransom is paid to unlock it.
SLIDE 4
Well that sucks, how do I get my data back?
SLIDE 5
Data Retrieval
u The easiest solution: keep a backup of your files.
SLIDE 6
Data Retrieval
u The easiest solution: keep a backup of your files. u If and when you system is compromised by
ransomware, you can use the backup to get back your files.
SLIDE 7
I don’t have a backup….
SLIDE 8
I don’t have a backup…. and I NEED those files!
SLIDE 9
This is really bad, can I prevent this?
SLIDE 10
Prevention
u CryptoDrop
SLIDE 11
Prevention
u CryptoDrop u SheildFS
SLIDE 12
Prevention
u CryptoDrop u SheildFS u PayBreak
SLIDE 13
None of those work very well, what now?
SLIDE 14
Redemption, Real-Time Protection
SLIDE 15
Redemption Design Overview
Two Components of Redemption
u A characterization of ransomware behavior based on
a large class of current ransomware.
u High performance and integrity mechanism to
restore attacked files.
SLIDE 16
Redemption Design Overview
SLIDE 17
How to determine Malice Score?
SLIDE 18
Malice Score
Two Components of Malice Score Calculation
u Content-based features u Behavior-based features
SLIDE 19
Content-Based Features
u Entropy Ratio of Data Blocks (Shannon Entropy)
SLIDE 20
Content-Based Features
u Entropy Ratio of Data Blocks (Shannon Entropy) u File Content Overwrite
SLIDE 21
Content-Based Features
u Entropy Ratio of Data Blocks (Shannon Entropy) u File Content Overwrite u Delete Operations
SLIDE 22
Behavior-based Features
u Directory Traversal
SLIDE 23
Behavior-based Features
u Directory Traversal u Converting Files to a Specific Type
SLIDE 24
Behavior-based Features
u Directory Traversal u Converting Files to a Specific Type u Access Frequency
SLIDE 25
Why two components of malice score calculation?
SLIDE 26
Why two components of malice score calculation?
SLIDE 27
Acceptable Malice Score
SLIDE 28
Testing Against Other Anti-Ransomware Applications
SLIDE 29
Overhead
SLIDE 30
Getting around Redemption
SLIDE 31
Social Engineering
u Aggravating a user to the point were they turn off
Redemption.
SLIDE 32
Attacking the Malice Score Calculation
u Selective content Overwrite u Low entropy payload u Periodic file destruction
SLIDE 33