Menu
Machine learning could help companies react faster to ransomware

Machine learning could help companies react faster to ransomware

Exabeam uses machine learning, behavior analytics to help companies contain ransomware infections

File-encrypting ransomware programs have become one of the biggest threats to corporate networks worldwide and are constantly evolving by adding increasingly sophisticated detection-evasion and propagation techniques.

In a world where any self-respecting malware author makes sure that his creations bypass antivirus detection before releasing them, enterprise security teams are forced to focus on improving their response times to infections rather than trying to prevent them all, which is likely to be a losing game.

Exabeam, a provider of user and entity behavior analytics, believes that machine-learning algorithms can significantly improve ransomware detection and reaction time, preventing such programs from spreading inside the network and affecting a larger number of systems.

Because the decryption price asked by ransomware authors is calculated per system, isolating affected computers as soon as possible is critical. Only last week the University of Calgary announced that it paid 20,000 Canadian dollars (around US$15,600) to ransomware authors to get the decryption keys for multiple systems.

Exabeam's Analytics for Ransomware, a new product that was announced today, uses the company's existing behavior analytics technology to detect ransomware infections shortly after they occur.

The product uses data from a company's existing logs to build behavior profiles for computers and users. This allows it to detect previously unknown ransomware without pre-existing detection signatures by analyzing anomalies in the file and document behavior of employees.

To avoid false positive detections, the technology flags incidents as ransomware when the combined risk score of multiple suspicious activities that could indicate this type of threat reaches a certain threshold.

Exabeam's security research team is helping train the product in a laboratory by executing a very large number of ransomware samples on test computers and letting it observe their behavior in order to build threat models.

ransomware detection exabeam behaviour machine learning Exabeam

Exabeam builds a threat score based on behavioural anomalies.

The product does not have blocking capabilities itself and is intended to be used by a company's security analysts to quickly spot and respond to security incidents. It is available as an add-on to the company's larger analytics platform, which can already detect violations of internal company security policies.

Even though there's no built-in threat neutralization functionality, the platform can integrate with other security tools and allow analysts to create administrative scripts that are executed automatically when an incident is detected -- for example, to immediately isolate an infected computer from the rest of the network.

Ransomware is typically distributed through drive-by download attacks and phishing emails, which means that computers are affected one-by-one, based on users' actions. However, in a corporate setting, ransomware can easily spread beyond a single computer by affecting files on document-sharing servers and other collaboration services used by employees.

Recently, some ransomware programs even gained worm-like, self-spreading capabilities. Once such threat is called ZCrypt and it copies itself to external USB drives, from where it's executed via rogue autorun.inf files.

By running a very large number of ransomware samples in a laboratory environment, the Exabeam researchers have also observed some interesting trends: for example, a recent increase in the ransom price.

"Two or three months ago most ransom values were between 0.4 and 1 bitcoin," said Barry Shteiman, the head of threat research at Exabeam. "That changed over the past month, the price now being between 2 and 5 bitcoins."

This could also be driven by the fact that many ransomware authors are now focused on targeting businesses, and companies are willing and able to pay more than consumers in order to recover critical business files.

Another interesting observation is that no new ransomware installer remains functional for more than a day.

This indicates that "ransomware campaigns are changing every day," Shteiman said. "It's like their creators work in DevOps mode, releasing new code to their spamming partners every day."


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Events

Why experience is the new battleground for partners

Join us for an exclusive webinar, in association with Hewlett Packard Enterprise and Technology Services Industry Association (TSIA) and learn about the latest industry insights and how technology services continue to evolve to deliver differentiated value, and how partners can be successful in 2021 and beyond.

Featured

Slideshows

Channel kicks 2021 into gear as After Hours returns to Auckland

Channel kicks 2021 into gear as After Hours returns to Auckland

After Hours made a welcome return to the channel social calendar with a bumper crowd of partners, distributors and vendors descending on The Pantry at Park Hyatt in Auckland to kick-start 2021.

Channel kicks 2021 into gear as After Hours returns to Auckland
The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards

Hundreds of leaders from the New Zealand IT industry gathered at the Hilton in Auckland on 17 November to celebrate the finest female talent in the Kiwi channel and recognise the winners of the Reseller News Women in ICT Awards (WIICTA) 2020.

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards
Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards

Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards

The leading female front runners of the New Zealand ICT industry joined together for the annual Reseller News Women in ICT Awards event at the Hilton in Auckland, during which hundreds of guests celebrated 13 outstanding individuals who won awards, chosen from more than 50 finalists representing over 30 organisations.

Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards
Show Comments