Ransomware's Early Mitigation Mechanisms - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2018

Ransomware's Early Mitigation Mechanisms

Résumé

Ransomware remains a modern trend. Attackers are still using cryptovirology forcing victims to pay. Notable attacks have been spreading since 2012, starting with Reveton's ran-somware attack to the more recent 2017 WannaCry, Petya and Bad Rabbit cyberattacks. This Ransomware as a Service (RaaS) can lure criminals into developing tools to perform an attack without previous knowledge of the cryptosystem itself. We present in this paper a graph-based ransomware countermeasure to detect malicious threads. It is a new mechanism that doesn't rely on previously used metrics in the literature to detect ransomware such as Shannon's entropy or system calls. An accurate detection is achieved by our solution. The per-thread file system traversal is sufficient to highlight the malicious behaviors. To the best of our knowledge , no previous study has been conducted in this area. The ransomware collection used in our experiments contains more than 700 active examples of ransomware, that were analyzed in our bar metal sandbox environment.
Ransomware.pdf (1.24 Mo) Télécharger le fichier

Dates et versions

hal-01894500 , version 1 (17-10-2018)

Identifiants

Citer

Routa Moussaileb, Benjamin Bouget, Aurélien Palisse, Hélène Le Bouder, Nora Cuppens-Boulahia, et al.. Ransomware's Early Mitigation Mechanisms. ARES 2018 - 13th International Conference on Availability, Reliability and Security, Aug 2018, Hambourg, Germany. ⟨10.1145/3230833.3234691⟩. ⟨hal-01894500⟩
230 Consultations
445 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More