💻 computer science

RABIS:Ransomware Analysis Based on Information Theory and System Calls

This paper proposes RABIS, a lightweight statistical approach that analyzes system call patterns to distinguish ransomware from benign processes, achieving 98.05% detection accuracy with minimal performance overhead.

Original authors: Pranitha Sanda, Harineesha Nutakki, Valli Sai Meghana Attili, Thapasvi Pooguri, Amrutha Varshini Astakala

Published 2026-10-15

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Pranitha Sanda, Harineesha Nutakki, Valli Sai Meghana Attili, Thapasvi Pooguri, Amrutha Varshini Astakala

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the digital world, every action a computer program takes is recorded as a series of requests to the operating system. When a program needs to open a file, save a document, or connect to a network, it must ask the computer's core software to do it. These requests are called system calls. For decades, security experts have watched these requests to spot trouble. The logic is straightforward: a normal program, like a word processor or a web browser, behaves in a complex and varied way because it is responding to a human user who is thinking, clicking, and typing in unpredictable patterns. Its requests to the computer are diverse and irregular. A malicious program, however, often has a single, rigid goal. If that goal is to steal or destroy data, the program will repeat the same few actions over and over again, asking the computer to open, read, encrypt, and rename thousands of files in a relentless, mechanical rhythm. This repetitive nature leaves a distinct fingerprint that is different from the chaotic noise of everyday software.

Researchers at the National Forensic Sciences University in India and the C. R. Rao Advanced Institute of Mathematics in Hyderabad have developed a new way to catch these malicious programs by measuring that rhythm. They call their method RABIS. Instead of trying to recognize a specific virus by its name or its code, which hackers can easily change, this approach looks at the statistical pattern of the program's behavior. They treat the sequence of system calls like a stream of data and measure how much variety exists within it. In their view, a healthy program is full of surprises and variety, while a ransomware program is boringly predictable. By calculating a value that represents this level of unpredictability, they can separate the dangerous programs from the safe ones without needing to know exactly what the virus is called or how it was built.

To test this idea, the team created a controlled environment where they could watch both safe and dangerous software in action. They gathered 150 examples of normal, everyday programs, such as text editors, calculators, web browsers, and command-line tools used by system administrators. They also obtained four distinct, real-world ransomware samples known by names like Conti, REvil, Monti, and SougoLock. These malicious programs are designed to lock up a user's files and demand money for the key. The researchers ran all these programs on a computer system that contained a large collection of files, simulating a real user's hard drive. As each program ran, a monitoring tool recorded every single request it made to the operating system, creating a detailed log of its behavior.

The core of their investigation involved breaking these long logs into small, overlapping groups of three requests at a time. They then counted how often each specific group of three appeared. For the normal programs, the logs showed a wide mix of different groups, with no single pattern repeating too often. The malicious programs, however, showed a very different picture. Because ransomware must process file after file in the same way, it kept repeating the exact same sequence of requests. The researchers used a mathematical concept known as entropy to quantify this difference. In simple terms, entropy measures how much disorder or randomness is present in a set of data. High entropy means the data is varied and hard to predict, which is what they saw in the safe programs. Low entropy means the data is repetitive and predictable, which is exactly what they found in the ransomware.

The results were striking. When the team applied their method, the malicious programs stood out clearly from the crowd. The four ransomware samples all showed very low entropy values, confirming their repetitive, mechanical nature. The 150 safe programs showed much higher values, reflecting their complex and varied behavior. The system correctly identified every single ransomware sample as dangerous. It did misclassify a small number of safe programs as threats, specifically those that happen to perform repetitive tasks, such as certain backup tools or antivirus software that scan many files. However, the overall accuracy of the method reached 98.05 percent. The researchers found that the larger the collection of files the ransomware tried to encrypt, the clearer its repetitive pattern became, making it even easier to spot.

This approach offers a significant advantage over older methods that rely on complex artificial intelligence models or massive databases of known virus signatures. Those older systems can be slow, require heavy computing power, and often fail when a hacker slightly alters a virus to make it look new. The RABIS method is lightweight and fast because it simply counts patterns and measures their variety. It does not need to be trained on thousands of examples of malware to work; it only needs to understand the difference between the chaotic behavior of a human-driven program and the rigid, repetitive behavior of a machine-driven attack. The researchers demonstrated that by focusing on the fundamental rhythm of how software talks to the computer, they can detect a ransomware attack as it happens, even if the virus has never been seen before.

While the method is highly effective, the researchers acknowledge that it is not perfect. The few safe programs that were flagged as threats were those that naturally perform repetitive file operations, which can sometimes mimic the behavior of an attacker. To handle this, the team suggests that future versions of the system could look at the context of the activity, such as how many files are being touched or how quickly the process is running, to reduce these false alarms. They also plan to expand the system to work across different types of computers, not just the specific operating system they tested. For now, the study proves that a simple statistical look at the way software behaves can be a powerful shield against one of the most destructive forms of cybercrime, offering a way to spot the threat by its lack of imagination.

Technical Summary of RABIS: Ransomware Analysis Based on Information Theory and System Calls

Problem Statement
Ransomware, particularly crypto-ransomware, has evolved into a highly lucrative and sophisticated threat, often delivered via Ransomware-as-a-Service (RaaS). These attacks cause significant financial damage and operational paralysis by encrypting user files. While existing detection methods rely heavily on static signatures or complex machine learning and graph-based models, these approaches often suffer from high computational overhead, reliance on large labeled datasets, or vulnerability to obfuscation. There is a critical need for detection techniques that are robust, accurate, and lightweight, capable of identifying malicious behavior in real-time without significant performance degradation.

Methodology
The authors propose RABIS (Ransomware Analysis Based on Information Theory and System Calls), a lightweight statistical approach that distinguishes benign processes from ransomware by analyzing low-level behavioral signatures derived from system calls. The core hypothesis is that ransomware exhibits highly repetitive, deterministic patterns (e.g., mass file read/write/rename operations) resulting in low entropy, whereas benign processes display diverse, user-driven, and irregular system call sequences resulting in high entropy.

The methodology is structured into three modules:

System Call Collection and Pattern Generation (Module 1):
- System calls are captured using strace in a controlled Linux environment.
- Raw traces are preprocessed to extract only system call names, removing arguments and return values to reduce noise.
- A sliding window technique is applied to generate fixed-length subsequences, known as n-grams (specifically trigrams in the primary experiments). These n-grams represent localized behavioral units of the process.
Behavioral Analysis and Entropy Computation (Module 2):
- A frequency dictionary is built for the n-grams of each process.
- Shannon Entropy is calculated based on the distribution of these n-grams. The formula $H(X) = -\sum p(x_i) \log_2(p(x_i))$ is used, where $p(x_i)$ is the probability of a specific pattern occurring.
- Low entropy indicates high repetition and predictability (characteristic of ransomware), while high entropy indicates randomness and diversity (characteristic of benign processes).
- To ensure comparability across processes with different trace lengths, the entropy values are normalized ( $NE_{prc}$ ) using the formula $NE_{prc} = E_{prc} / \log(S)$ , where $S$ is the sum of all pattern frequencies.
Classification and Thresholding (Module 3):
- The system assumes the normalized entropy of benign processes follows a normal distribution.
- A statistical threshold ( $Th$ ) is established using a left-tailed confidence interval approach. The threshold is calculated as $Th = \mu_{NE} - z \cdot \sigma_{NE}$ , where $\mu_{NE}$ is the mean and $\sigma_{NE}$ is the standard deviation of the normalized entropy of benign processes.
- Processes with $NE_{prc} < Th$ are classified as ransomware, while those with $NE_{prc} > Th$ are classified as benign.

Experimental Setup
The study was conducted on Ubuntu 22.04.5 LTS systems.

Benign Dataset: 150 distinct benign processes, including command-line tools (e.g., ls, cat), GUI applications (e.g., Firefox, Evince), and an antivirus tool (ClamAV).
Malicious Dataset: 4 distinct ransomware binaries (Conti, REvil, Monti, SougoLock) sourced from MalwareBazaar.
Environment: Ransomware samples were executed in isolated environments with access to two datasets: a low-volume set (48,035 files, 14.1 GB) and a high-volume set (134,557 files, >34 GB).

Key Results

Accuracy: RABIS achieved a classification accuracy of 98.05%.
False Negatives: The system recorded zero false negatives, correctly identifying all four ransomware variants.
False Positives: A small number of benign processes were misclassified as ransomware. The authors attribute this to benign utilities (e.g., clamav, settings) that perform bursty, repetitive file-system operations, mimicking ransomware patterns.
n-gram Analysis: Experiments with n-gram sizes ranging from 3 to 15 indicated that trigrams (n=3) yielded the highest accuracy. The authors suggest this is because fundamental file operations (open $\to$ write $\to$ close) naturally form three-step sequences, providing sufficient context without the noise sensitivity of longer sequences.
Data Volume Impact: Detection signatures became more pronounced as the volume of encrypted data increased, except for the SougoLock variant, which targets system directories regardless of dataset size, maintaining a consistent execution pattern.

Significance and Claims
The paper claims that RABIS offers a computationally efficient alternative to complex machine learning and graph-based detection models. By leveraging information theory (Shannon entropy) on system call patterns, the approach:

Avoids the overhead of training deep learning models or maintaining large signature databases.
Provides an interpretable mechanism for detection based on statistical behavioral anomalies.
Demonstrates high reliability in distinguishing crypto-ransomware from benign processes, even in scenarios involving high-frequency file operations.

The authors emphasize that while the method is robust, it requires careful threshold tuning to minimize false positives from legitimate high-throughput system utilities. The work concludes that RABIS is a practical framework for runtime behavioral analysis, suitable for environments where resource constraints preclude heavy computational models.

More like this