RThreatDroid: A Ransomware Detection Approach to Secure IoT Based Healthcare Systems

The use of smartphone devices in healthcare has increased manifold due to their widespread use and ease of integration with Internet of Things (IoT) based medical devices. In healthcare, either in-home observation or in a hospital scenario, medical sensors use certain local communication devices to share measured vital signs with a fog/cloud-based medical system. The large user community of Android devices has also brought some serious challenges, such as potential malicious attacks. For the past few years, ransomware attacks on healthcare have been increasing dramatically, posing several challenges. Therefore, an effective ransomware detection mechanism is needed to protect critical assets such as healthcare data, patients’ private data, etc. In this work, a novel hybrid ransomware detection method is proposed that analyzes image data, text, and application code to extract plain or encrypted threat text. Threatening text is a potential tool and could be one of the most effective features for ransomware detection. Our proposed hybrid approach utilizes both static and dynamic techniques and uses multi-machine learning classifier models. The proposed approach also provides a family classification of ransomware. Experimental results show that the proposed approach achieves up to 94% accuracy and fewer false negatives.