Augmented YARA Rules Fused with Fuzzy Hashing in Ransomware Triaging

Nitin Naik, Paul Jenkins, Nick Savage, Longzhi Yang, Kshirasagar Naik, Jingping Song

Research output: Chapter in Book/Published conference outputConference publication

Abstract

Triaging is an initial stage of malware analysis to assess whether a sample is malware or not and the degree of similarity it holds with known malware. It can be applied to any malware category such as ransomware, which is a type of malware that blocks access to a system or data, usually by encrypting it. It has become the main modus operandi for cybercriminals to extort monies from victims due to the growth of cryptocurrencies. Consequently, it severely affects all types of users whether they be from corporates or ordinary home users. Ransomware can be prevented in several different ways, however, the simple and initial step in prevention is its triaging without execution. Several triaging methods are in use such as fuzzy hashing, import hashing and YARA rules, amongst all, YARA rules are one of the most popular and widely used methods. Nonetheless, its success or failure is dependent on the quality of rules employed for malware triaging. This paper performs ransomware triaging using fuzzy hashing, import hashing and YARA rules and demonstrates how YARA rules can be improved using fuzzy hashing to obtain relatively better triaging results. Subsequently, it proposes the augmented YARA rules fused with fuzzy hashing to obtain improved triaging results and performance efficiency in comparison to all three triaging methods individually. Finally, the paper demonstrates how the use of the fused YARA rules can improve triaging results irrespective of the type of malware.

Original languageEnglish
Title of host publication2019 IEEE Symposium Series on Computational Intelligence, SSCI 2019
PublisherIEEE
Pages625-632
Number of pages8
ISBN (Electronic)9781728124858
ISBN (Print)978-1-7281-2486-5
DOIs
Publication statusPublished - 20 Feb 2020
Event2019 IEEE Symposium Series on Computational Intelligence, SSCI 2019 - Xiamen, China
Duration: 6 Dec 20199 Dec 2019

Publication series

Name2019 IEEE Symposium Series on Computational Intelligence, SSCI 2019

Conference

Conference2019 IEEE Symposium Series on Computational Intelligence, SSCI 2019
Country/TerritoryChina
CityXiamen
Period6/12/199/12/19

Bibliographical note

© 2020 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

Keywords

  • fuzzy hashing
  • import hashing
  • mvhash-b
  • ran-somware
  • sdhash
  • ssdeep
  • wannacry
  • wannacryptor
  • yara rules

Fingerprint

Dive into the research topics of 'Augmented YARA Rules Fused with Fuzzy Hashing in Ransomware Triaging'. Together they form a unique fingerprint.

Cite this