Protecting against Ransomware: A New Line of Research or Restating Classic Ideas?

Amin Kharraz, William K. Robertson, Engin Kirda

Abstract: Ransomware is a type of extortion-based attack that locks the victim’s digital resources and requests money to release them. The recent resurgence of high-profile ransomware attacks, particularly in critical sectors such as the healthcare industry, has highlighted the pressing need for effective defenses. While users are always advised to have a reliable backup strategy, the growing number of paying victims in recent years suggests that new defense mechanisms that minimize the destructive effects of ransomware attacks are needed. However, there are undeniable similarities between ransomware and other types of malware attacks. Hence, the two main questions that are often asked are: What are the challenges in defending against ransomware that can be solved using existing malware detection techniques? And, what are the new intellectual challenges that require developing new tools and techniques? In this article, we summarize some of the challenges in developing anti-ransomware solutions by considering the similarities and differences between ransomware and other types of malware attacks.