RTCatch: a Real-time Detection Method to Combat Evolving Rust Language Ransomware

Abstract Rust has garnered increasing attention as a programming language known for its high security and efficiency. However, new evidence suggests that attackers are now using Rust to develop novel ransomware variants, aiming to evade detection tools and maximize destructive capabilities. In this paper, we construct a real-world dataset consisting of 1823 Rust-based ransomware samples and conduct the empirical study that analyzes their behavioral patterns, revealing six attack features and two evasion mechanisms. Extensive observations show that Rust-based ransomware exhibits distinct behaviors compared to benign software, including semantically fragmented multi-process encryption and unique encryption patterns. Based on these insights, we design a lightweight and real-time detection method called RTCatch to counter evolving Rust-based ransomware attacks. The core of RTCatch lies in process correlation, which aggregates ransomware features across correlated processes, effectively addressing the challenge of feature dispersion caused by multi-process encryption. Experimental results demonstrate that RTCatch achieves a recall of 98.68% on the constructed dataset and performs rapid inference in 253 ms with a maximum response time of 2.97 s while incurring minimal computational and storage overhead. Furthermore, large-scale tests on 873 traditional ransomware samples show that RTCatch maintains consistent detection performance, indicating its robustness across different ransomware families.