# Minerva: A File-Based Ransomware Detector

**Authors:** Dorjan Hitaj, Giulio Pagnotta, Fabio De Gaspari, Lorenzo De Carli, Luigi V. Mancini  
**arXiv:** [2301.11050](https://arxiv.org/abs/2301.11050)  
**Date:** 2023-01-26  
**Summary page:** https://www.summarizepaper.com/en/paper/2301.11050v2/

## Key points

- Ransomware attacks have caused significant financial losses, with billions of dollars in damages already incurred and projections indicating a continued trend in the future.
- Efforts have been made to develop effective ransomware detection and mitigation strategies.
- Behavioral-based ransomware detection has gained traction, analyzing process-based behavioral profiles to identify malicious activities.
- Existing behavioral detection techniques are vulnerable to evasion attacks, highlighting the need for more robust solutions.
- Minerva is introduced as a novel approach to ransomware detection designed to be resilient against evasion tactics.
- Minerva accurately detects ransomware activity within an average of 0.52 seconds from the onset of malicious behavior and exhibits strong resilience against adaptive ransomware.
- Minerva's design focuses on file-based behavioral profiles and contrastive design principles for effective identification of ransomware processes based on their interactions with files during periods of suspicious activity.
- The architecture of Minerva is built on the insight that changes in one aspect of a file's behavioral profile can trigger detectable alterations in other aspects, making it more difficult for evasive ransomware to go undetected.

## Summary

In recent years, ransomware attacks have caused significant financial losses, with billions of dollars in damages already incurred and projections indicating that this trend will continue in the future. As a result, there has been a concerted effort to develop effective ransomware detection and mitigation strategies. One approach that has gained traction is behavioral-based ransomware detection, which relies on analyzing process-based behavioral profiles to identify malicious activities. However, existing behavioral detection techniques are vulnerable to evasion attacks, highlighting the need for more robust solutions. In response to this challenge, Hitaj et al. introduce Minerva, a novel approach to ransomware detection designed to be resilient against evasion tactics. By carefully selecting features and architectural components that are less susceptible to adversarial manipulation, Minerva aims to provide a comprehensive solution to the ransomware problem. The authors conduct a thorough analysis of Minerva's performance across various types of ransomware, including both known and unseen variants as well as those specifically crafted to evade detection. Their evaluation demonstrates that Minerva is capable of accurately detecting ransomware activity within an average of 0.52 seconds from the onset of malicious behavior. Moreover, Minerva exhibits strong resilience against adaptive ransomware designed to evade its detection mechanisms. One key aspect of Minerva's design is its focus on file-based behavioral profiles and contrastive design principles. By analyzing the operations performed on individual files within defined time windows, Minerva can effectively identify ransomware processes based on their interactions with files during periods of suspicious activity. The architecture of Minerva is built on the insight that changes in one aspect of a file's behavioral profile can trigger detectable alterations in other aspects, making it more difficult for evasive ransomware to go undetected. Overall, Hitaj et al. 's work makes significant contributions by proposing a robust ransomware detection system that overcomes limitations associated with traditional behavioral approaches. With its emphasis on file-level analysis and contrastive design principles, Minerva represents a promising advancement in the ongoing battle against ransomware threats.