However, it cannot prevent attacks by ransomware without obtaining information on the ransomware. Traditional vaccine system can detect a system if it is infected with ransomware and cure it. Smart device operating system market share. Damage cases of Android-based smartphones are continuously growing recently. The share of the Android platform is so high that the platform is the main target of ransomware attacks. Compared to other OS such as iOS, Windows Phone, or Blackberry, Android holds a high market share close to monopoly, while the others combined have less than 15% share in the mobile device market. The market share of Korea’s Android OS is approximately 80% of the total share of smartphone market as shown in Table 1. The rapid growth of the mobile market has been the main target of hackers to obtain illegal gains by using ransomware. Ransomware is a type of malware that uses malicious codes to intrude the system before users notice it, to encrypt important files, to require money using encrypted files as a hostage, and to give monetary damages to users. In addition, it can effectively determine modified patterns of ransomware and provide protection with minimum damage. Its speed of detection is very fast because it can be implemented in Android source code instead of mobile application. The proposed technique can detect ransomware even if you do not save its patterns. The information of suspected and exceptional processes confirmed by users is stored in a database. If the process running a suspicious ransomware is detected, the proposed system will stop the process and take steps to confirm the deletion of programs associated with the process from users. The proposed technique specifies and intensively monitors processes and specific file directories using statistical methods based on Processor usage, Memory usage, and I/O rates so that the process with abnormal behaviors can be detected. In this paper, an effective method is proposed to prevent the attacks of modified ransomware on Android platform. More effective technique is required to prevent modified ransomware. The existing vaccine systems are vulnerable to attacks of new pattern ransomware because they can only detect the ransomware of existing patterns. Due to recent indiscriminate attacks of ransomware, damage cases including encryption of users’ important files are constantly increasing.

Android process monitor 2016