SaTC: TTP: Small: Deployable Behavior-driven Crypto-ransomware Detection Enabled by Practical Logging Strategies

Crypto-ransomware extorts money from victims by encrypting their files. Ransomware attacks cause severe disruptions to everyday life of many individuals and organizations such as the Colonial Pipeline hack which affected nearly half of the U.S. East Coast gas supply. Studies found that in successful ransomware attacks, 77 percent of the victims were running up-to-date endpoint protection. Thus, existing endpoint cybersecurity solutions for ransomware defense need to be strengthened. There is an urgent need to pinpoint the security gap and improve the effectiveness and deployability of ransomware detection technologies. This project aims to address this gap by developing advanced real-time cybersecurity monitoring technologies. The ability to avoid service disruptions and prevent loss of critical data helps stabilize the modern society that critically depends on the availability of computing infrastructures. To monitor system behaviors efficiently at runtime for ransomware detection, we need to overcome a major obstacle of heavy logging overhead, which includes both runtime slowdown and high storage needs. This project team comprehensively evaluates different logging schedules and systematically measures their impact on detection capabilities in real-world environments. In addition, the team aims to create a set of innovative log analysis algorithms for identifying anomalies efficiently and effectively to drastically enhance the current endpoint intrusion detection capabilities. The proposed work on deployable ransomware defenses helps democratize advanced behavior-based cybersecurity solutions to low-resource high-risk organizations, e.g., local and state governments, hospitals, utility companies, and schools. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.