I/O Request Packet (IRP) Logs Driven Ransomware Detection Scheme

The project aims to extract pattern(s) of malicious processes (e.g., ransomware) from the IRP logs that were generated by running 272 ransomware samples on a Windows machine. Besides, there are labelled benign IRP logs that were recorded in different sessions of users' machine which did not have any malicious program installed.

All the ransomware samples were labelled and grouped with its families with the help of AVClass - a malware labelling tool and VirusTotal API engine. After the datasets are processed and labelled, we constructed an Artificial Neural Network (ANN) model in order to perform binary classification (detection of benign and malicious logs).

The research project has been published at the IEEE 21st International Conference on Information Reuse and Integration for Data Science (IEEE IRI 2020).

Acknowledgement

We would like to thank Andrea Continella, Ph.D. to provide us with the datasets that we have used on this project as well as collaborate in our research project. The research paper (Continella et al.) can be found here: SheildFS 2016.

Citing this work

If you use our implementation for academic research, you are highly encouraged to cite our paper.

@inproceedings{ayub2020request,
  title={An I/O Request Packet (IRP) Driven Effective Ransomware Detection Scheme using Artificial Neural Network},
  author={Ayub, Md Ahsan and Continella, Andrea and Siraj, Ambareen},
  booktitle={2020 IEEE 21st International Conference on Information Reuse and Integration for Data Science (IRI)},
  pages={319--324},
  year={2020},
  organization={IEEE}
}

The work has been entire funded by Cybersecurity Education, Research & Outreach Center (CEROC) at Tennessee Tech University.