Methods and systems for protecting computer systems from encryption-based malware
The present disclosure includes descriptions of methods and systems for executing a countermeasure against executed ransomware and for extracting an encryption key used by the ransomware. Embodiments disclosed herein comprise analyzing power consumption data of one or more processors executing the ransomware.
1 . A malware detection system comprising:
one or more processors; and
non-transitory, computer readable media, communicatively connected to the one or more processors, including processor-executable instructions that when executed by the one or more processors cause the malware detection system to perform the following operations:
generating total power consumption data of a monitored system;
analyzing, using a machine learning system, the generated total power consumption data including comparing the generated total power consumption data to stored power consumption data generated during encryption of files that are known to have differentiable power signatures when encrypted, the files including a first file having a first power signature and a second file having a second power signature different than the first power signature, and the first file and the second file are stored on the monitored system; and
in response to the analysis:
detecting malware executed by the monitored system; and
detecting a use of an encryption key by the malware.
2 . The malware detection system of claim 1 , wherein responding to the analysis further includes:
identifying an encryption key used by the malware to recover the encryption key used by the malware.
3 . The malware detection system of claim 1 , wherein responding to the analysis further includes executing a countermeasure against the malware.
4 . The malware detection system of claim 1 , wherein the generated total power consumption data includes statistical analysis of power consumption measurements of the monitored system.
5 . The malware detection system of claim 1 , wherein detecting malware includes identifying one or more computer-executable instructions of the malware.
6 . The malware detection system of claim 5 , wherein the identified one or more computer-executable instructions correspond to an encryption process of the malware.
7 . The malware detection system of claim 1 , further comprising:
a power supply,
wherein detecting malware includes identifying that an encryption is being performed, and wherein the operations include inserting a fault injection attack on the power supply.
8 . The malware detection system of claim 1 , wherein analyzing the generated total power consumption data includes performing a statistical analysis of the generated total power consumption data.
9 . The malware detection system of claim 1 , wherein analyzing the generated total power consumption data includes classifying the generated total power consumption data with the machine learning system.
10 . The malware detection system of claim 1 , wherein analyzing the generated total power consumption data includes analyzing the generated total power consumption data in combination with metadata of the malware detection system.
11 . The malware detection system of claim 10 , wherein the metadata includes one or more measurements of I/O activities of the malware detection system, one or more measurements of processor usage, one or measurements of memory usage, opened files, usage of an AES-NI encryption engine, and/or more measurements of power drawn by subsystems of the malware detection system.
12 . The malware detection system of claim 1 , wherein the one or more processors and the non-transitory, computer readable media are included on a host device, the malware detection system further comprising:
an external device including:
a communication module configured to plug into the host device;
memory including predetermined files, the predetermined files being accessible by the host device when the external device is plugged into the host device via the communication module; and
a processor communicatively connected to the communication module and the memory, the processor configured to perform operations of:
monitoring a state of the predetermined files;
detecting a change in the state of the predetermined files; and
in response to detecting the change in the state of the predetermined files, performing operations of:
triggering performance of host prevention operations.
13 . The malware detection system of claim 12 , wherein the predetermined files are mapped to the host device as user files when the external device is plugged into the host device.
14 . The malware detection system of claim 12 , wherein responding to the analysis includes extracting the encryption key used by the malware.
15 . The malware detection system of claim 12 , wherein the non-transitory, computer readable media of the host device includes a privileged executable or a driver that is configured to be aware of the external device and configured to execute the prevention operations.
16 . The malware detection system of claim 12 , wherein the accessibility of the predetermined files to the host device is constructed such that the predetermined files are targeted first by a specific malware.
17 . The malware detection system of claim 16 , wherein filenames of the predetermined files are constructed such that malware that targets files in alphabetical order targets the predetermined files first.
18 . A malware detection network, comprising:
at least one malware detection system, comprising:
at least one port predetermined to be accessible to malware attacks;
one or more processors; and
non-transitory, computer readable media, communicatively connected to the one or more processors, including processor-executable instructions that when executed by the one or more processors cause the at least one malware detection system to perform the following operations:
generating total power consumption data for a monitored system;
analyzing, using a machine learning system, the generated power consumption data including comparing the generated total power consumption data to stored power consumption data generated during encryption of files that are known to have differentiable power signatures when encrypted, the files including a first file having a first power signature and a second file having a second power signature different than the first power signature, and the first file and the second file are stored on the monitored system; and
in response to the analysis:
detecting malware executed by the monitored system; and
detecting a use of an encryption key by the malware.
19 . The malware detection network of claim 18 , wherein responding to the analysis further includes extracting the encryption key used by the malware.
20 . The malware detection network of claim 18 , wherein responding to the analysis further includes executing a countermeasure against the malware.
21 . The malware detection network of claim 18 , wherein the generated total power consumption data includes statistical analysis of power consumption measurements of the monitored system.
22 . The malware detection network of claim 18 , wherein detecting malware includes identifying one or more computer-executable instructions of the malware.