  Crypto-ransomware has caused an unprecedented scope of impact in recent years
with an evolving level of sophistication. We are in urgent need to pinpoint the
security gap and improve the effectiveness of defenses by identifying new
detection approaches. In this paper, we quantitatively characterized the
runtime behaviors of 54 ransomware samples from 35 distinct families, with a
focus on the core encryption and file access behaviors. Based on our
characterization results on dynamic API behaviors of ransomware, we present a
new API profiling-based detection mechanism. Our method consists of two
operations, namely consistency analysis and API-contrast-based refinement. We
evaluate our approach against a set of real-world ransomware as well as benign
samples. The results show that our method effectively detects all ransomware
executions in the consistency analysis and further reduces the false positive
case in API-contrast refinement. We also conduct in-depth case studies to
investigate the most informative APIs for detection with context.
