The ransomware detection and prevention tool design by using signature and anomaly based detection methods

Ransomware, which constantly improves by updating itself and transferring to the network and computing environment, is the most common type of malware used by the attackers recently. Ransomware demands ransom from the user for decrypting the encrypted files. As a result of the payment of the desired amount of ransom, the files can be opened with the decryption key delivered to the user. Various antivirus software using signature-based detection method fail to detect the malware because they perform analysis via hash signature samples in databases. Because hash signature samples of zero-day attacks are not recorded in antivirus software databases, detecting ransomware by using anomaly-based detection method is more effective. The most important factor for anomaly-based detection method is to be able to analyze the data sufficiently to determine the ability and the behavior of the ransomware. This method consists of two phases. These are "training/learning" and "monitoring/detecting" phases. In training phase, many academic publications, international cyber security vendors' reports on ransomware, and interview with cyber security experts have been examined and utilized during bringing out our study, and consequently, the attack vectors of the ransomware, the core features, the identification methods and the movements based on the Windows OSs have been found. That is, machine learning techniques have not been used, and so all materials have been evaluated as inputs to the design of our tool. In our study, after presenting the behavior of the ransomware in detail, in the monitoring/detecting phase, how the ransomware detection and prevention tool should be created to detect and prevent ransomware on Windows OSs will be explained. It is also evident that the tool in the hybrid structure using signature-based detection method, along with anomaly-based detection method, will be even more successful in detecting and preventing ransomware with minimum false-positive rate and minimum file loss. We consider that we can give a better perspective to the users, software developers, and security administrators about the key features of the ransomware detection and prevention tool that can be used as a solution that does not require high fees for commercial software to protect against ransomware, and we can more easily take measures against ransomware. In our study, the code written in the Python programming language of the ransomware detection and prevention tool proposed in the Appendices of our study is also presented. This code, which is open to development, is thought to be an example of the design of a commercial ransomware detection and prevention tool and maybe a guide to future academic studies on ransomware and other malicious software.