Search
Close this search box.
Search
Close this search box.

Case study

Ransomware, currently the biggest threat to cybersecurity

Challenge

Ransomware, currently the biggest threat to cybersecurity, is a type of malicious software that encrypts an organization's data, demanding a ransom for its decryption. The goal of the project is to create a tool for dynamic ransomware detection.

Share this:

Organisation profile

Sagenso offers proprietary, innovative tools for analyzing and monitoring cyber threats for companies.

Our SaaS platform, Telescope, functions as a virtual company manager in the area of cybersecurity management and a virtual auditor available 24/7. With it, one can efficiently and independently conduct IT security audits and secure key areas of the company. Ransom SpAI, developed in collaboration with MIM Solutions, is next-generation Ransomware Defense software that detects unauthorized mass file encryption processes by malicious software.

Solution

Ransom SpAI, software created by Sagenso in collaboration with MIM Solutions, operates by continuously monitoring processes and computer resources, detecting ransomware right after its activation.

Unlike competitors focusing on protecting individual machines, Ransom SpAI emphasizes minimizing the impact of an attack and protecting the organization. To achieve this, we have created a system that includes:

Software installed on user computers, consisting of:

  • Component monitoring processes and resources.
  • Proprietary ML algorithm created by MIM Solutions.
  • Fast, local response element, as well as reporting to the central management system.

Management center that:

  • Monitors the status of each computer and informs the client of potential threats.
  • In the event of a threat reported by one machine, raises the readiness status of other machines by modifying ML operation. This component was developed in collaboration with MIM Solutions.

Results

We have created a prototype ready for Proof of Concept (POC). In internal tests simulating an attack on an organization by simultaneously launching ransomware on multiple virtual machines, Ransom SpAI achieved over 99% effectiveness in detecting unknown types of ransomware, those that the ML model had not encountered during training.

Fast detection (below 45 seconds from ransomware activation) and a low number of encrypted files (3.2% of files) are promising results for the future. The innovative ML model created by MIM Solutions has been submitted for publication in Knowledge and Information Systems.

This model has been uniquely adapted to our needs, providing:

  • Fast action, speeding up threat detection.
    Model interpretability, facilitating continuous improvement and adaptation to changing threats.
  • The original method of detecting ransomware attack symptoms and the training method are currently awaiting patent approval.

Get in touch

MIM Solutions can help develop AI in your company, please contact us and we’ll talk you through it.