On the Effectiveness of System API-Related Information for Android
  Ransomware Detection
  Ransomware constitutes a significant threat to the Android operating system.
It can either lock or encrypt the target devices, and victims are forced to pay
ransoms to restore their data. Hence, the prompt detection of such attacks has
a priority in comparison to other malicious threats. Previous works on Android
malware detection mainly focused on Machine Learning-oriented approaches that
were tailored to identifying malware families, without a clear focus on
ransomware. More specifically, such approaches resorted to complex information
types such as permissions, user-implemented API calls, and native calls.
However, this led to significant drawbacks concerning complexity, resilience
against obfuscation, and explainability. To overcome these issues, in this
paper, we propose and discuss learning-based detection strategies that rely on
System API information. These techniques leverage the fact that ransomware
attacks heavily resort to System API to perform their actions, and allow
distinguishing between generic malware, ransomware and goodware.
  We tested three different ways of employing System API information, i.e.,
through packages, classes, and methods, and we compared their performances to
other, more complex state-of-the-art approaches. The attained results showed
that systems based on System API could detect ransomware and generic malware
with very good accuracy, comparable to systems that employed more complex
information. Moreover, the proposed systems could accurately detect novel
samples in the wild and showed resilience against static obfuscation attempts.
Finally, to guarantee early on-device detection, we developed and released on
the Android platform a complete ransomware and malware detector (R-PackDroid)
that employed one of the methodologies proposed in this paper.
