Unmasking of Maskware: Detection and Prevention of Next-Generation Mobile Crypto-Ransomware

Malware is advancing at a rapid pace, and it is becoming more stealthy, resilient, and aware of the existing detection methods. A similar trend in mobile crypto-ransomware can be expected soon. Thus, it is crucial to investigate the problem of new variants of mobile crypto-ransomware that may emerge in the near future. Hence, this work investigates how next-generation advanced mobile crypto-ransomware can evade the existing state-of-the-art detection metrics and how it is possible to neutralize this threat. After reviewing the current data-centric crypto-ransomware detection metrics, we investigate the possibility of evading them. We demonstrate the threat posed by next-generation mobile crypto-ransomware by implementing a crypto-ransomware targeted for the Android operating system called Maskware. Maskware uses partial encryption and mimics the behavior of legitimate applications in terms of data manipulation. We evaluate the effectiveness of common crypto-ransomware detection metrics, including entropy, data transformation, and file structure, in the detection of Maskware. We demonstrate that such metrics are ineffective in detecting Maskware. Hence, this article suggests using more efficient and effective methods to combat such malware and proposes a novel solution. The evaluation results of the proposed solution demonstrate that it can effectively detect Maskware and protect users’ data.