Poster: MUSTARD - Adaptive Behavioral Analysis for Ransomware Detection

Davide Sanvito, Giuseppe Siracusano, Roberto Gonzalez, Roberto Bifulco

Abstract: Behavioural analysis based on filesystem operations is one of the most promising approaches for the detection of ransomware. Nonetheless, tracking all the operations on all the files for all the processes can introduce a significant overhead on the monitored system. We present MUSTARD, a solution to dynamically adapt the degree of monitoring for each process based on their behaviour to achieve a reduction of monitoring resources for the benign processes.