# A Ransomware Classification Framework Based on File-Deletion and File-Encryption Attack Structures

**Authors:** Aaron Zimba, Mumbi Chishimba, Sipiwe Chihana  
**arXiv:** [2102.10632](https://arxiv.org/abs/2102.10632)  
**Date:** 2021-02-21  
**Summary page:** https://www.summarizepaper.com/en/paper/2102.10632v1/

## Key points

- Comprehensive framework for classifying ransomware attacks based on file-deletion and file-encryption attack structures
- Aims to provide a deeper understanding of flaws and inadequacies in ransomware
- Categorization based on target platform, cryptosystem used, severity of data loss, and attack structure
- Classification framework considers encryption as a core aspect of the ransomware business model
- Severity categories range from CAT1 to CAT5, with CAT4 and CAT5 being the most severe
- Many ransomwares exhibit flaws in their implementation of encryption and deletion attack structures, making data recovery possible without paying the ransom
- Suggests mitigation strategies for different severity categories (CAT4 and CAT5 through exploiting encryption essentials, CAT3 through reverse engineering)
- Sections II to VI discuss taxonomy, proposed classification framework, methodology and approach, classification results and analysis, and conclusions respectively

## Summary

This paper presents a comprehensive framework for classifying ransomware attacks based on their file-deletion and file-encryption attack structures. The authors aim to provide a deeper understanding of the flaws and inadequacies exhibited in ransomware, helping victims make informed decisions about whether or not to pay a ransom demand. The paper begins by discussing the taxonomy and threat model associated with ransomware attacks. The categorization of attacks is based on several characteristics, including the target platform, cryptosystem used, severity of data loss, and attack structure. This categorization is independent of the underlying infection vectors. The proposed classification framework considers encryption as a core aspect of the ransomware business model. It classifies ransomware attacks into different categories based on the virulence of the attack and the effectiveness of potential ways to recover data without paying the ransom. The severity categories range from CAT1 to CAT5, with CAT4 and CAT5 being the most severe. The results of the categorization reveal that many ransomwares exhibit flaws in their implementation of encryption and deletion attack structures, making data recovery possible without paying the ransom. The paper suggests that CAT4 and CAT5 can be better mitigated by exploiting encryption essentials, while CAT3 can be effectively mitigated through reverse engineering. On the other hand, CAT1 and CAT2 are less common and easily mitigated without decryption essentials. The rest of the paper is organized as follows: Section II discusses the taxonomy, threat model, and associated attack structures; Section III presents the proposed classification framework; Section IV describes the methodology and approach; Section V presents classification results and analysis; and finally, Section VI draws conclusions. Overall, this paper provides valuable insights into understanding different types of ransomware attacks and offers guidance on how to mitigate their impact effectively.