A Method for Neutralizing Entropy Measurement-Based Ransomware Detection Technologies Using Encoding Algorithms

Area of Science:

• Computer Science
• Cybersecurity
• Information Security

Background:

• Ransomware encrypts files, increasing entropy, which is used for detection.
• Attackers now use encoding (e.g., Base64) to mask entropy increases, evading detection.

Purpose of the Study:

• To analyze the limitations of current entropy-based ransomware detection.
• To propose a method to neutralize ransomware detection by employing sophisticated entropy measurement techniques.

Main Methods:

• Analyzing existing entropy measurement-based ransomware detection.
• Investigating the impact of various encoding algorithms (including Base64) on file entropy.
• Developing a more advanced entropy measurement approach.

Main Results:

• Demonstrated how encoding algorithms can neutralize entropy-based ransomware detection.
• Identified specific limitations of current detection methods when faced with encoded files.
• Proposed a refined entropy measurement strategy.

Conclusions:

• Current entropy-based ransomware detection is vulnerable to encoding techniques.
• Advanced entropy measurement methods are necessary to counter sophisticated evasion tactics.
• The proposed method offers a more robust defense against evolving ransomware threats.