University Lab Develops Sensor-based Ransomware Detection Software

guest · May 15, 2020

Univ. Lab Develops Ransomware Detection Software
Engineers from SMU’s Darwin Deason Institute for Cybersecurity have developed software to detect ransomware attacks before attackers can inflict catastrophic damage
May 14, 2020
https://sciencebusiness.technewslit.com/?p=39084

A computer science lab at Southern Methodist University developed software that the researchers say detects ransomware before damage can occur. The software is designed by graduate students at SMU’s Deason cyber security institute in Dallas, Texas, and according to tests can stop new types of ransomware not encountered before.

The team’s software, called sensor-based ransomware detection, tracks the physical state of a system by monitoring sensors built into modern computers, such as power consumption and hardware performance counters in central processing units or CPUs. As a result, the software does not rely on known software signatures of suspected attackers, and can prevent so-called zero-day ransomware, perpetrated by completely novel attacks where no previous defenses are installed.

In a paper describing the software given at a 2017 conference, the researchers say their tests show sensor-based ransomware detection stops 95 percent of zero-day ransomware before they get started, with a 6 percent false-positive rate.

“The results of testing this technique,” says Taylor in a university statement, “indicate that rogue encryption processes can be detected within a very small fraction of the time required to completely lock down all of a user’s sensitive data files. So the technique detects instances of ransomware very quickly and well before extensive damage occurs to the victim’s computer files.”
Click to expand...

The university says it filed for a U.S. patent on the technology.
Click to expand...

Paper: "Sensor-based Ransomware Detection" (PDF - 606 KB): https://s2.smu.edu/~mitch/ftp_dir/pubs/ftc17.pdf

Rasheed187 · May 23, 2020

I'm sorry, but a protection rate of 95% and false positive rate a 6% really isn't good enough. I believe a tool like HMPA which looks at file system behavior will probably score better.

Log in or Sign up

University Lab Develops Sensor-based Ransomware Detection Software

guest Guest

Rasheed187 Registered Member

Log in or Sign up

University Lab Develops Sensor-based Ransomware Detection Software

guest Guest

Rasheed187 Registered Member

Useful Searches