It Solutions: Machine learning could help companies react faster to ransomware

Share This

Machine learning, behavior analytics are used to help companies contain ransomware infections

File-encrypting ransomware programs have become one of the biggest threats to corporate networks worldwide and are constantly evolving by adding increasingly sophisticated detection-evasion and propagation techniques.

In a world where any self-respecting malware author makes sure that his creations bypass antivirus detection before releasing them, enterprise security teams are forced to focus on improving their response times to infections rather than trying to prevent them all, which is likely to be a losing game.

Providers of user and entity behavior analytics, believe that machine-learning algorithms can significantly improve ransomware detection and reaction time, preventing such programs from spreading inside the network and affecting a larger number of systems.

Because the decryption price asked by ransomware authors is calculated per system, isolating affected computers as soon as possible is critical. Only last week the University of Calgary announced that it paid 20,000 Canadian dollars (around US$15,600) to ransomware authors to get the decryption keys for multiple systems.

Exabeam’s Analytics for Ransomware, a new product that was announced today, uses the company’s existing behavior analytics technology to detect ransomware infections shortly after they occur.

The product uses data from a company’s existing logs to build behavior profiles for computers and users. This allows it to detect previously unknown ransomware without pre-existing detection signatures by analyzing anomalies in the file and document behavior of employees.

To avoid false positive detections, the technology flags incidents as ransomware when the combined risk score of multiple suspicious activities that could indicate this type of threat reaches a certain threshold.

The research team is helping train the product in a laboratory by executing a very large number of ransomware samples on test computers and letting it observe their behavior in order to build threat models.

The product does not have blocking capabilities itself and is intended to be used by a company’s security analysts to quickly spot and respond to security incidents. It is available as an add-on to the company’s larger analytics platform, which can already detect violations of internal company security policies.

Even though there’s no built-in threat neutralization functionality, the platform can integrate with other security tools and allow analysts to create administrative scripts that are executed automatically when an incident is detected — for example, to immediately isolate an infected computer from the rest of the network.

Ransomware is typically distributed through drive-by download attacks and phishing emails, which means that computers are affected one-by-one, based on users’ actions. However, in a corporate setting, ransomware can easily spread beyond a single computer by affecting files on document-sharing servers and other collaboration services used by employees.

Recently, some ransomware programs even gained worm-like, self-spreading capabilities. Once such threat is called ZCrypt and it copies itself to external USB drives, from where it is executed via rogue autorun.inf files.

By running a very large number of ransomware samples in a laboratory environment, the Exabeam researchers have also observed some interesting trends: for example, a recent increase in the ransom price.

This could also be driven by the fact that many ransomware authors are now focused on targeting businesses, and companies are willing and able to pay more than consumers in order to recover critical business files.

Another interesting observation is that no new ransomware installer remains functional for more than a day.

This may indicate that ransomware campaigns are changing every day and that their creators work in DevOps mode, releasing new code to their spamming partners every day.