undo-ransomware/ransomware_detection

Rework file analysis and classification

Closed this issue · 1 comments

ilovemilk commented
  • File name analysis doesn't produce the results that were intended due to the misleading file name entropy. Therefore, remove the file name analysis.
  • Extend the signature collection of extensions and their file header signature.
  • File extension and corruption analysis: A unknown file extension is suspicious but the file is not corrupted. A known file extension is not suspicious but can be corrupted.
  • Rework the classification regarding these changes.
ilovemilk commented

See release v0.3.2.