Menu
Machine learning could help companies react faster to ransomware

Machine learning could help companies react faster to ransomware

Exabeam uses machine learning, behavior analytics to help companies contain ransomware infections

File-encrypting ransomware programs have become one of the biggest threats to corporate networks worldwide and are constantly evolving by adding increasingly sophisticated detection-evasion and propagation techniques.

In a world where any self-respecting malware author makes sure that his creations bypass antivirus detection before releasing them, enterprise security teams are forced to focus on improving their response times to infections rather than trying to prevent them all, which is likely to be a losing game.

Exabeam, a provider of user and entity behavior analytics, believes that machine-learning algorithms can significantly improve ransomware detection and reaction time, preventing such programs from spreading inside the network and affecting a larger number of systems.

Because the decryption price asked by ransomware authors is calculated per system, isolating affected computers as soon as possible is critical. Only last week the University of Calgary announced that it paid 20,000 Canadian dollars (around US$15,600) to ransomware authors to get the decryption keys for multiple systems.

Exabeam's Analytics for Ransomware, a new product that was announced today, uses the company's existing behavior analytics technology to detect ransomware infections shortly after they occur.

The product uses data from a company's existing logs to build behavior profiles for computers and users. This allows it to detect previously unknown ransomware without pre-existing detection signatures by analyzing anomalies in the file and document behavior of employees.

To avoid false positive detections, the technology flags incidents as ransomware when the combined risk score of multiple suspicious activities that could indicate this type of threat reaches a certain threshold.

Exabeam's security research team is helping train the product in a laboratory by executing a very large number of ransomware samples on test computers and letting it observe their behavior in order to build threat models.

ransomware detection exabeam behaviour machine learning Exabeam

Exabeam builds a threat score based on behavioural anomalies.

The product does not have blocking capabilities itself and is intended to be used by a company's security analysts to quickly spot and respond to security incidents. It is available as an add-on to the company's larger analytics platform, which can already detect violations of internal company security policies.

Even though there's no built-in threat neutralization functionality, the platform can integrate with other security tools and allow analysts to create administrative scripts that are executed automatically when an incident is detected -- for example, to immediately isolate an infected computer from the rest of the network.

Ransomware is typically distributed through drive-by download attacks and phishing emails, which means that computers are affected one-by-one, based on users' actions. However, in a corporate setting, ransomware can easily spread beyond a single computer by affecting files on document-sharing servers and other collaboration services used by employees.

Recently, some ransomware programs even gained worm-like, self-spreading capabilities. Once such threat is called ZCrypt and it copies itself to external USB drives, from where it's executed via rogue autorun.inf files.

By running a very large number of ransomware samples in a laboratory environment, the Exabeam researchers have also observed some interesting trends: for example, a recent increase in the ransom price.

"Two or three months ago most ransom values were between 0.4 and 1 bitcoin," said Barry Shteiman, the head of threat research at Exabeam. "That changed over the past month, the price now being between 2 and 5 bitcoins."

This could also be driven by the fact that many ransomware authors are now focused on targeting businesses, and companies are willing and able to pay more than consumers in order to recover critical business files.

Another interesting observation is that no new ransomware installer remains functional for more than a day.

This indicates that "ransomware campaigns are changing every day," Shteiman said. "It's like their creators work in DevOps mode, releasing new code to their spamming partners every day."

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments