Neutralization Method of Ransomware Detection Technology Using Format Preserving Encryption.

Area of Science:

• Cybersecurity
• Malware Analysis
• Information Security

Background:

• Ransomware employs file encryption to extort victims, posing a significant threat.
• Existing detection methods, including entropy measurement, have limitations and can be bypassed.
• Ransomware neutralization techniques using encoding, like base64, are vulnerable to detection after decoding.

Purpose of the Study:

• To develop an advanced ransomware detection-neutralization method resilient to current bypass techniques.
• To propose neutralization requirements from an attacker's perspective for enhanced efficacy.
• To introduce format-preserving encryption as a superior alternative to encoding for ransomware neutralization.

Main Methods:

• Derived three attacker-centric requirements for sophisticated neutralization: no decoding, secret information support, and ciphertext entropy similar to plaintext.
• Utilized format-preserving encryption (FPE) to manipulate ciphertext entropy and bypass detection.
• Evaluated Byte Split, BinaryToASCII, and Radix Conversion methods for FPE application, identifying Radix Conversion as optimal.

Main Results:

• The proposed method using Radix Conversion with FPE satisfies the derived requirements, enabling encryption without decoding.
• Achieved a 96% neutralization accuracy for PPTX files at an entropy threshold of 0.5, significantly outperforming existing methods.
• Demonstrated the effectiveness of FPE in controlling ciphertext entropy for advanced ransomware neutralization.

Conclusions:

• Format-preserving encryption offers a robust solution for ransomware neutralization, overcoming limitations of encoding-based methods.
• The Radix Conversion method, combined with FPE, provides a highly effective strategy for evading entropy-based ransomware detection.
• This research offers critical insights for developing future countermeasures against sophisticated ransomware neutralization tactics.