UNVEIL: A Large-Scale, Automated Approach to Detecting Ransomware
summary
UNVEIL is a dynamic analysis system that auto-generates an artificial user environment and installs a kernel file‑system monitor to log IRPs, read/write buffers and compute entropy change on I/O; it also computes a structural similarity score to catch desktop lockers. Deployed on 56 analysis machines, it runs samples for ~20 minutes, processed ~148k submissions, flags 9.2% as ransomware, reports 72% of its detections as previously unseen, yields zero false positives on the labeled set at the chosen threshold, and uncovers a new family called Silent Crypt.
AI-written summary · about
chapters (26)
- 0:00Introduction
- 0:25What is ransomware
- 1:12Typical ransom node
- 1:31Recent resurgence of ransomware
- 2:04Recent attack on hospitals
- 2:16Massachusetts
- 2:51Three Approaches
- 4:16Thread Model
- 7:12Tools and Techniques
- 7:23Our Approach
- 7:55Two Classes of Ransomware
- 9:25Generated Content
- 10:35Ransomware Families
- 13:20Encryption
- 14:46Similarity Score
- 15:13Test System
- 17:35Data Source
- 18:25False Negative Cases
- 19:14Unknown Data Set
- 20:28Pollution Ratio
- 21:44Summary
- 22:26Silent Crypt
- 23:47VirusTotal
- 23:58Google Results
- 24:15Conclusion
- 25:13Question Answer
related talks
40mRansomware: Creation, Detection, and Response
14mBehind the scenes w/ SentinelOne’s MDR: Detecting cloud ransomware
36mBehind Enemy Lines:Engaging and Disrupting Ransomware Web Panels
29mRendering Ransomware Detection and EDR Products Blind
37mThe 2024 Ransomware Threat Landscape: What's Fueling the Epidemic?
54mVirtual Session: How to Perform Ransomware Analysis
29mNo More Ransomware in Critical Infrastructure!
14mThe Conjuring: ransomware edition!!