Search papers, labs, and topics across Lattice.
This study reframes ransomware execution as a Search-Based Software Engineering (SBSE) optimization problem, leveraging Genetic Algorithms (GA) to create low-entropy encryption patterns that evade detection by modern defense systems. By imposing constraints on statistical deviations from baseline system activity, the researchers successfully developed ransomware that can remain undetected for extended periods. The findings underscore the effectiveness of search-based methods in generating evasive malware, posing significant challenges for automated security defenses.
Evolved ransomware can now elude detection for hours by optimizing encryption patterns through Genetic Algorithms, raising the stakes for cybersecurity.
Traditional ransomware deployment often relies on massive encryption procedure, triggering immediate detection by modern defense systems. This work introduces a paradigm shift in cryptographic attacks by framing ransomware execution as a Search-Based Software Engineering (SBSE) optimization problem. This approach addresses the persistence gap observed in modern threats, where attacks aim to remain undercover for hours rather than minutes. Using a Genetic Algorithm (GA), we optimize data encryption under a hard constraint on the statistical deviation from baseline system activity. We demonstrate that our evolved attack patterns can evade behavioral monitors under fingerprinting techniques. Our results suggest that search-based methods provide a powerful framework for generating evasive malware, highlighting an emerging challenge for automated software defense.
