Lightweight Crypto-Ransomware Detection in Android Based on Reactive Honeyfile Monitoring

Area of Science:

• Cybersecurity and Information Security
• Mobile Device Security
• Malware Detection

Background:

• Ransomware poses a significant threat to individuals and organizations globally.
• Mobile and IoT devices are increasingly targeted, necessitating tailored security solutions.
• Existing machine learning-based ransomware mitigation schemes are often too resource-intensive for mobile platforms.

Purpose of the Study:

• To develop an effective and efficient ransomware detection tool specifically for Android platforms.
• To address the limitations of high computational cost and resource consumption in current mobile security solutions.
• To adapt a previously developed honeyfile detection solution for a mobile operating system.

Main Methods:

• Implementation of a ransomware detection tool for Android.
• Strategic deployment of trap files across the target file system.
• Utilization of the FileObserver service for early detection of suspicious file access patterns.

Main Results:

• The developed tool demonstrates high detection accuracy for ransomware on Android devices.
• The solution exhibits significant efficiency in terms of resource consumption and performance.
• Experimental results validate the effectiveness of the trap file and reactive monitoring approach.

Conclusions:

• The proposed ransomware detection method is feasible and practical for resource-constrained Android environments.
• Combining trap files with reactive monitoring offers a viable alternative to computationally expensive machine learning models.
• This approach enhances mobile security against the growing threat of ransomware.