A User-friendly Model for Ransomware Analysis Using Sandboxing
Source abstract
Abstract
Ransomware is a type of malicious software that blocks access to a computer by encrypting user’s files until a ransom is paid to the attacker. There have been several reported high-profile ransomware attacks including WannaCry, Petya, and Bad Rabbit resulting in losses of over a billion dollars to various individuals and businesses in the world. The analysis of ransomware is often carried out via sandbox environments; however, the initial setup and configuration of such environments is a challenging task. Also, it is difficult for an ordinary computer user to correctly interpret the complex results presented in the reports generated by such environments and analysis tools. In this research work, we aim to develop a user-friendly model to understand the taxonomy and analysis of ransomware attacks. Also, we aim to present the results of analysis in the form of summarized reports that can easily be understood by an ordinary computer user. Our model is built on top of the well-known Cuckoo sandbox environment for identification of the ransomware as well as generation of the summarized reports. In addition, for evaluating the usability and accessibility of our proposed model, we conduct a comprehensive user survey consisting of participants from various fields, e.g., professional developers from software houses, people from academia (professors, students). Our evaluation results demonstrate a positive feedback of approximately 92% on the usability of our proposed model.
Source: openalex_inverted_index · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Digital and Cyber Forensics · Network Security and Intrusion Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
References (21)
Show source-provided references
1. Ransomware: Evolution, mitigation and prevention
2. B. Jethva, “A new ransomware detection scheme based on tracking file signature and file entropy,” Ph.D. dissertation. University of Victoria, Canada, 2019.
3. B. Celiktas and E. Karacuha, “The ransomware detection and prevention tool design by using signature and anomaly based detection methods,” Ph.D. dissertation. Istanbul Technical University, Turkey, 2018.
4. Large scale ransomware detection by cognitive security
5. Dridex: Analysis of the traffic and automatic generation of IOCS
6. Behavioral-based classification and identification of ransomware variants using machine learning
7. An investigation on wannacry ransomware and its detection
8. IoT based ransomware growth rate evaluation and detection using command and control blacklisting
9. R-killer: An email based ransomware protection tool
10. Heldroid: Dissecting and detecting mobile ransomware
11. Ransomware threat success factors, taxonomy, and countermeasures: A survey and research directions10.1016/j.cose.2018.01.001 ↗
12. Static and dynamic analysis of third generation cerber ransomware
13. Automated behavioral analysis of malware: A case study of wannacry ransomware
14. Ransomware attacks: Detection, prevention and cure10.1016/S1353-4858(16)30086-1 ↗
15. An approach for detection and family classification of malware based on behavioral analysis
16. Comparative analysis of various ransomware virii10.1007/s11416-008-0092-2 ↗
17. Detecting Ransomware with Honeypot Techniques
18. A behavioural-based approach to ransomware detection
19. Detecting Ransomware Using Process Behavior Analysis10.1016/j.procs.2020.02.249 ↗
20. A framework for systematic classification of assets for security testing10.32604/cmc.2020.012831 ↗
21. C. Sandbox, “Cuckoo Sandbox—Automated Malware Analysis,” 2017. [Online]. Available: http://www.cuckoosandbox.org.