| Title | A Ransomware Detection Method Using Fuzzy Hashing for Mitigating the Risk of Occlusion of Information Systems |
| Publication Type | Conference Paper |
| Year of Publication | 2019 |
| Authors | Naik, Nitin, Jenkins, Paul, Savage, Nick |
| Conference Name | 2019 International Symposium on Systems Engineering (ISSE) |
| Date Published | oct |
| Keywords | codebase, composability, cryptography, file organisation, Fuzzy Hashing, fuzzy hashing methods, fuzzy set theory, fuzzy similarity scores, Information systems, invasive software, k-means clustering, malware prevention strategy, Metrics, mvHASH-B, organisational aspects, organisational information systems, pattern clustering, probability, pubcrawl, ransomware, ransomware attacks, ransomware corpus, ransomware detection method, ransomware samples, Resiliency, SDHASH, similarity detection success rate, similarity preserving hashing, similarity preserving hashing method, SSDEEP, threat actors, unknown ransomware variants, WannaCry, WannaCryptor |
| Abstract | Today, a significant threat to organisational information systems is ransomware that can completely occlude the information system by denying access to its data. To reduce this exposure and damage from ransomware attacks, organisations are obliged to concentrate explicitly on the threat of ransomware, alongside their malware prevention strategy. In attempting to prevent the escalation of ransomware attacks, it is important to account for their polymorphic behaviour and dispersion of inexhaustible versions. However, a number of ransomware samples possess similarity as they are created by similar groups of threat actors. A particular threat actor or group often adopts similar practices or codebase to create unlimited versions of their ransomware. As a result of these common traits and codebase, it is probable that new or unknown ransomware variants can be detected based on a comparison with their originating or existing samples. Therefore, this paper presents a detection method for ransomware by employing a similarity preserving hashing method called fuzzy hashing. This detection method is applied on the collected WannaCry or WannaCryptor ransomware corpus utilising three fuzzy hashing methods SSDEEP, SDHASH and mvHASH-B to evaluate the similarity detection success rate by each method. Moreover, their fuzzy similarity scores are utilised to cluster the collected ransomware corpus and its results are compared to determine the relative accuracy of the selected fuzzy hashing methods. |
| DOI | 10.1109/ISSE46696.2019.8984540 |
| Citation Key | naik_ransomware_2019 |
A Ransomware Detection Method Using Fuzzy Hashing for Mitigating the Risk of Occlusion of Information Systems