CanCal: Towards Real-time and Lightweight Ransomware Detection and Response in Industrial Environments
<|reference_start|>CanCal: Towards Real-time and Lightweight Ransomware Detection and Response in Industrial Environments: Ransomware attacks have emerged as one of the most significant cybersecurity threats. Despite numerous proposed detection and defense methods, existing approaches face two fundamental limitations in large-scale industrial applications: intolerable system overheads and notorious alert fatigue. To address these challenges, we propose CanCal, a real-time and lightweight ransomware detection system. Specifically, CanCal selectively filters suspicious processes by the monitoring layers and then performs in-depth behavioral analysis to isolate ransomware activities from benign operations, minimizing alert fatigue while ensuring lightweight computational and storage overhead. The experimental results on a large-scale industrial environment~(1,761 ransomware, ~3 million events, continuous test over 5 months) indicate that CanCal is as effective as state-of-the-art techniques while enabling rapid inference within 30ms and real-time response within a maximum of 3 seconds. CanCal dramatically reduces average CPU utilization by 91.04% (from 6.7% to 0.6%) and peak CPU utilization by 76.69% (from 26.6% to 6.2%), while avoiding 76.50% (from 3,192 to 750) of the inspection efforts from security analysts. By the time of this writing, CanCal has been integrated into a commercial product and successfully deployed on 3.32 million endpoints for over a year. From March 2023 to April 2024, CanCal successfully detected and thwarted 61 ransomware attacks, demonstrating the effectiveness of CanCal in combating sophisticated ransomware threats in real-world scenarios.<|reference_end|>
@article{wang2024cancal:,
    title={CanCal: Towards Real-time and Lightweight Ransomware Detection and
  Response in Industrial Environments},
    author={Shenao Wang, Feng Dong, Hangfeng Yang, Jingheng Xu, Haoyu Wang},
    journal={arXiv preprint arXiv:2408.16515},
    year={2024},
    doi={10.1145/3658644.3690269},
    archivePrefix={arXiv},
    eprint={2408.16515},
    primaryClass={cs.CR}
}