Machine learning could help companies react faster to ransomware

Exabeam uses machine learning, behavior analytics to help companies contain ransomware infections

File-encrypting ransomware programs have become one of the biggest threats to corporate networks worldwide and are constantly evolving by adding increasingly sophisticated detection-evasion and propagation techniques.

In a world where any self-respecting malware author makes sure that his creations bypass antivirus detection before releasing them, enterprise security teams are forced to focus on improving their response times to infections rather than trying to prevent them all, which is likely to be a losing game.

Exabeam, a provider of user and entity behavior analytics, believes that machine-learning algorithms can significantly improve ransomware detection and reaction time, preventing such programs from spreading inside the network and affecting a larger number of systems.

Because the decryption price asked by ransomware authors is calculated per system, isolating affected computers as soon as possible is critical. Only last week the University of Calgary announced that it paid 20,000 Canadian dollars (around US$15,600) to ransomware authors to get the decryption keys for multiple systems.

Exabeam's Analytics for Ransomware, a new product that was announced today, uses the company's existing behavior analytics technology to detect ransomware infections shortly after they occur.

The product uses data from a company's existing logs to build behavior profiles for computers and users. This allows it to detect previously unknown ransomware without pre-existing detection signatures by analyzing anomalies in the file and document behavior of employees.

To avoid false positive detections, the technology flags incidents as ransomware when the combined risk score of multiple suspicious activities that could indicate this type of threat reaches a certain threshold.

Exabeam's security research team is helping train the product in a laboratory by executing a very large number of ransomware samples on test computers and letting it observe their behavior in order to build threat models.

ransomware detection exabeam behaviour machine learning Exabeam

Exabeam builds a threat score based on behavioural anomalies.

The product does not have blocking capabilities itself and is intended to be used by a company's security analysts to quickly spot and respond to security incidents. It is available as an add-on to the company's larger analytics platform, which can already detect violations of internal company security policies.

Even though there's no built-in threat neutralization functionality, the platform can integrate with other security tools and allow analysts to create administrative scripts that are executed automatically when an incident is detected -- for example, to immediately isolate an infected computer from the rest of the network.

Ransomware is typically distributed through drive-by download attacks and phishing emails, which means that computers are affected one-by-one, based on users' actions. However, in a corporate setting, ransomware can easily spread beyond a single computer by affecting files on document-sharing servers and other collaboration services used by employees.

Recently, some ransomware programs even gained worm-like, self-spreading capabilities. Once such threat is called ZCrypt and it copies itself to external USB drives, from where it's executed via rogue autorun.inf files.

By running a very large number of ransomware samples in a laboratory environment, the Exabeam researchers have also observed some interesting trends: for example, a recent increase in the ransom price.

"Two or three months ago most ransom values were between 0.4 and 1 bitcoin," said Barry Shteiman, the head of threat research at Exabeam. "That changed over the past month, the price now being between 2 and 5 bitcoins."

This could also be driven by the fact that many ransomware authors are now focused on targeting businesses, and companies are willing and able to pay more than consumers in order to recover critical business files.

Another interesting observation is that no new ransomware installer remains functional for more than a day.

This indicates that "ransomware campaigns are changing every day," Shteiman said. "It's like their creators work in DevOps mode, releasing new code to their spamming partners every day."

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?