NDSS 2025 – ERW-Radar

Why It Matters

As ransomware continues to evolve, evading conventional defenses by mimicking benign behavior, a detection approach that spots subtle, repeatable I/O signatures offers a more resilient line of defense. This matters for security teams and organizations seeking practical, low‑overhead solutions that can be deployed in real‑time environments, making the research timely amid rising ransomware threats.

Summary

The episode delves into ERW‑Radar, a novel detection system designed to combat evasive ransomware by leveraging the unique repetitive I/O patterns ransomware exhibits during encryption and statistical analysis of encrypted byte streams. The authors—Lingbo Zhao, Yuhui Zhang, Zhilu Wang, Fengkai Yuan, and Rui Hou—explain three core innovations: a contextual correlation mechanism for behavior detection, fine‑grained content analysis to spot encrypted files, and adaptive controls that balance detection accuracy with resource overhead. Experimental results show ERW‑Radar achieves 96.18% detection accuracy with a 5.36% false‑positive rate while adding only modest CPU (5.09%) and memory (3.80%) overhead. Their work highlights the limitations of traditional antivirus solutions against sophisticated, behavior‑mimicking ransomware.