We use Rust for an opensource malware detection engine. It's great at detecting ransomwares and we want to share results and ideas with you.

Dear community,

We are working on #machinelearning applied to behavioural data for #ransomware detection.

This is a 3-components PCA (50% of variance is explained) applied to behavioural data from #ransomware and legit programs, as collected by Owlyshield. Trajectories should be interpreted as the evolution of programs activities over time :

​

3-component PCA showing Ransomware\/legit binaries behaviours

​

What is interesting is that we can build a separating hyperplane (a SVM works well but xgboost shows outstanding performances).

We focus solely on the activity of programs (or families of programs) in terms of disk activities (read and write). Behaviours are collected by Owlyshield, our open-source anti-malware engine we created and maintain. Owlyshield is a dynamic project and the quantity of metrics we collect is increasing rapidly.

We work with timeseries of aggregated data that describe the evolution of the activity of a family of process over time. Some examples of such features :

• Count of read/setinfo/write operations,
• Total read/write bytes,
• Total read/write entropy,
• Count of files opened/deleted/read/renamed/written,
• Clustering operations on directories path with files updated,
• ...

As of now #Owlyshield is only available on Windows (minifilters make accessing I/O request packets (IRPs) easy). We would like to work on the Linux support but we are still unsure if recompiling the kernel is required to monitor low-level read/write activity. Fuse may be an option. Let us know what you think may be a good way to implement it.