Using sequences of API Calls to identify and classify ransomware families

This paper presents a Machine Learning based approach to properly identify and classify Ransomware families based on API sub-sequence features. The increase in ransomware activity in the last few years and its destructive capacity need a proper response. Studying the known methods to evade detection (performed by threat actors), we propose a generic method to properly identify specific traits of a ransomware family. Our method is based on discriminant API Call sub-sequences. Another goal of our research is to identify code similarities between ransomware families, hence the usage of the malware-as-a-service concept in ransomware-based attacks. The database used for training and validating our approach consists of 19,563 ransomware samples, 52 families and 416 campaigns (activity months), collected starting in 2020. Our experimental results show that sub-sequences of API calls can be successfully used to identify ransomware traits. However, this method is strongly dependent on the quality of the implemented emulator. We conclude our research by suggesting three scenarios derived from our solution that can be implemented in a security solution.