# Minerva: A File-Based Ransomware Detector

arXiv: https://arxiv.org/abs/2301.11050 · HTML: https://mlsanity.com/paper/2301.11050/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 10 of its 66 references that are in the map.
- First posted on arXiv 26 Jan 2023.

## Builds on (most cited first, 10 of 10)

- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- [Black-Box Attacks against RNN based Malware Detection Algorithms](https://mlsanity.com/paper/1705.08131/) (2017)
- [Capture the Bot: Using Adversarial Examples to Improve CAPTCHA Robustness to Bot Attacks](https://mlsanity.com/paper/2010.16204/) (2020)
- [The Naked Sun: Malicious Cooperation Between Benign-Looking Processes](https://mlsanity.com/paper/1911.02423/) (2019)
- [Reliable Detection of Compressed and Encrypted Data](https://mlsanity.com/paper/2103.17059/) (2021)
- [MalPhase: Fine-Grained Malware Detection Using Network Flow Data](https://mlsanity.com/paper/2106.00541/) (2021)
- [A Few-Shot Meta-Learning based Siamese Neural Network using Entropy Features for Ransomware Classification](https://mlsanity.com/paper/2112.00668/) (2021)
- [Machine Learning Aided Static Malware Analysis: A Survey and Tutorial](https://mlsanity.com/paper/1808.01201/) (2018)
- [Black-box Attacks Against Neural Binary Function Detection](https://mlsanity.com/paper/2208.11667/) (2022)
- [Query-Efficient Black-Box Attack Against Sequence-Based Malware Classifiers](https://mlsanity.com/paper/1804.08778/) (2018)

## Built on by (most cited first, 1 of 1)

- [Do You Trust Your Model? Emerging Malware Threats in the Deep Learning Ecosystem](https://mlsanity.com/paper/2403.03593/) (2024)

## Abstract (arXiv)

Ransomware attacks have caused billions of dollars in damages in recent years, and are expected to cause billions more in the future. Consequently, significant effort has been devoted to ransomware detection and mitigation. Behavioral-based ransomware detection approaches have garnered considerable attention recently. These behavioral detectors typically rely on process-based behavioral profiles to identify malicious behaviors. However, with an increasing body of literature highlighting the vulnerability of such approaches to evasion attacks, a comprehensive solution to the ransomware problem remains elusive. This paper presents Minerva, a novel, robust approach to ransomware detection. Minerva is engineered to be robust by design against evasion attacks, with architectural and feature selection choices informed by their resilience to adversarial manipulation. We conduct a comprehensive analysis of Minerva across a diverse spectrum of ransomware types, encompassing unseen ransomware as well as variants designed specifically to evade Minerva. Our evaluation showcases the ability of Minerva to accurately identify ransomware, generalize to unseen threats, and withstand evasion attacks. Furthermore, over 99% of detected ransomware are identified within 0.52sec of activity, enabling the adoption of data loss prevention techniques with near-zero overhead.