  Emergence of crypto-ransomware has significantly changed the cyber threat
landscape. A crypto ransomware removes data custodian access by encrypting
valuable data on victims' computers and requests a ransom payment to
reinstantiate custodian access by decrypting data. Timely detection of
ransomware very much depends on how quickly and accurately system logs can be
mined to hunt abnormalities and stop the evil. In this paper we first setup an
environment to collect activity logs of 517 Locky ransomware samples, 535
Cerber ransomware samples and 572 samples of TeslaCrypt ransomware. We utilize
Sequential Pattern Mining to find Maximal Frequent Patterns (MFP) of activities
within different ransomware families as candidate features for classification
using J48, Random Forest, Bagging and MLP algorithms. We could achieve 99%
accuracy in detecting ransomware instances from goodware samples and 96.5%
accuracy in detecting family of a given ransomware sample. Our results indicate
usefulness and practicality of applying pattern mining techniques in detection
of good features for ransomware hunting. Moreover, we showed existence of
distinctive frequent patterns within different ransomware families which can be
used for identification of a ransomware sample family for building intelligence
about threat actors and threat profile of a given target.
