A ransomware detection method using fuzzy hashing for mitigating the risk of occlusion of information systems

Nitin Naik, Paul Jenkins, Nick Savage

Research output: Chapter in Book/Published conference outputConference publication

Abstract

Today, a significant threat to organisational information systems is ransomware that can completely occlude the information system by denying access to its data. To reduce this exposure and damage from ransomware attacks, organisations are obliged to concentrate explicitly on the threat of ransomware, alongside their malware prevention strategy. In attempting to prevent the escalation of ransomware attacks, it is important to account for their polymorphic behaviour and dispersion of inexhaustible versions. However, a number of ransomware samples possess similarity as they are created by similar groups of threat actors. A particular threat actor or group often adopts similar practices or codebase to create unlimited versions of their ransomware. As a result of these common traits and codebase, it is probable that new or unknown ransomware variants can be detected based on a comparison with their originating or existing samples. Therefore, this paper presents a detection method for ransomware by employing a similarity preserving hashing method called fuzzy hashing. This detection method is applied on the collected WannaCry or WannaCryptor ransomware corpus utilising three fuzzy hashing methods SSDEEP, SDHASH and mvHASH-B to evaluate the similarity detection success rate by each method. Moreover, their fuzzy similarity scores are utilised to cluster the collected ransomware corpus and its results are compared to determine the relative accuracy of the selected fuzzy hashing methods.

Original languageEnglish
Title of host publicationISSE 2019 - 5th IEEE International Symposium on Systems Engineering, Proceedings
PublisherIEEE
ISBN (Electronic)9781728117836
DOIs
Publication statusPublished - 6 Feb 2020
Event5th Annual IEEE International Symposium on Systems Engineering, ISSE 2019 - Edinburgh, United Kingdom
Duration: 1 Oct 20193 Oct 2019

Publication series

NameISSE 2019 - 5th IEEE International Symposium on Systems Engineering, Proceedings
PublisherIEEE
ISSN (Print)2687-881X
ISSN (Electronic)2687-8828

Conference

Conference5th Annual IEEE International Symposium on Systems Engineering, ISSE 2019
Country/TerritoryUnited Kingdom
CityEdinburgh
Period1/10/193/10/19

Bibliographical note

Publisher Copyright:
© 2019 IEEE.

Copyright:
Copyright 2020 Elsevier B.V., All rights reserved.

Keywords

  • Fuzzy Hashing
  • K-Means Clustering
  • mvHASH-B
  • Ransomware
  • SDHASH
  • Similarity Preserving Hashing
  • SSDEEP
  • WannaCry
  • WannaCryptor

Fingerprint

Dive into the research topics of 'A ransomware detection method using fuzzy hashing for mitigating the risk of occlusion of information systems'. Together they form a unique fingerprint.

Cite this