Today, a significant threat to organisational information systems is ransomware that can completely occlude the information system by denying access to its data. To reduce this exposure and damage from ransomware attacks, organisations are obliged to concentrate explicitly on the threat of ransomware, alongside their malware prevention strategy. In attempting to prevent the escalation of ransomware attacks, it is important to account for their polymorphic behaviour and dispersion of inexhaustible versions. However, a number of ransomware samples possess similarity as they are created by similar groups of threat actors. A particular threat actor or group often adopts similar practices or codebase to create unlimited versions of their ransomware. As a result of these common traits and codebase, it is probable that new or unknown ransomware variants can be detected based on a comparison with their originating or existing samples. Therefore, this paper presents a detection method for ransomware by employing a similarity preserving hashing method called fuzzy hashing. This detection method is applied on the collected WannaCry or WannaCryptor ransomware corpus utilising three fuzzy hashing methods SSDEEP, SDHASH and mvHASH-B to evaluate the similarity detection success rate by each method. Moreover, their fuzzy similarity scores are utilised to cluster the collected ransomware corpus and its results are compared to determine the relative accuracy of the selected fuzzy hashing methods.
|Title of host publication||ISSE 2019 - 5th IEEE International Symposium on Systems Engineering, Proceedings|
|Publication status||Published - 6 Feb 2020|
|Event||5th Annual IEEE International Symposium on Systems Engineering, ISSE 2019 - Edinburgh, United Kingdom|
Duration: 1 Oct 2019 → 3 Oct 2019
|Name||ISSE 2019 - 5th IEEE International Symposium on Systems Engineering, Proceedings|
|Conference||5th Annual IEEE International Symposium on Systems Engineering, ISSE 2019|
|Period||1/10/19 → 3/10/19|
Bibliographical notePublisher Copyright:
© 2019 IEEE.
Copyright 2020 Elsevier B.V., All rights reserved.
- Fuzzy Hashing
- K-Means Clustering
- Similarity Preserving Hashing