Cyberthreat Hunting - Part 2: Tracking Ransomware Threat Actors using Fuzzy Hashing and Fuzzy C-Means Clustering

Nitin Naik, Paul Jenkins, Nick Savage, Longzhi Yang

Research output: Chapter in Book/Report/Conference proceedingConference publication

Abstract

Threat actors are constantly seeking new attack surfaces, with ransomeware being one the most successful attack vectors that have been used for financial g ain. T his has been achieved through the dispersion of unlimited polymorphic samples of ransomware whilst those responsible evade detection and hide their identity. Nonetheless, every ransomware threat actor adopts some similar style or uses some common patterns in their malicious code writing, which can be significant evidence contributing to their identification. T he fi rst st ep in attempting to identify the source of the attack is to cluster a large number of ransomware samples based on very little or no information about the samples, accordingly, their traits and signatures can be analysed and identified. T herefore, t his p aper p roposes an efficient fuzzy analysis approach to cluster ransomware samples based on the combination of two fuzzy techniques fuzzy hashing and fuzzy c-means (FCM) clustering. Unlike other clustering techniques, FCM can directly utilise similarity scores generated by a fuzzy hashing method and cluster them into similar groups without requiring additional transformational steps to obtain distance among objects for clustering. Thus, it reduces the computational overheads by utilising fuzzy similarity scores obtained at the time of initial triaging of whether the sample is known or unknown ransomware. The performance of the proposed fuzzy method is compared against k-means clustering and the two fuzzy hashing methods SSDEEP and SDHASH which are evaluated based on their FCM clustering results to understand how the similarity score affects the clustering results.

Original languageEnglish
Title of host publication2019 IEEE International Conference on Fuzzy Systems, FUZZ 2019
PublisherIEEE
ISBN (Electronic)9781538617281
DOIs
Publication statusPublished - 10 Oct 2019
Event2019 IEEE International Conference on Fuzzy Systems, FUZZ 2019 - New Orleans, United States
Duration: 23 Jun 201926 Jun 2019

Publication series

NameIEEE International Conference on Fuzzy Systems
Volume2019-June
ISSN (Print)1098-7584

Conference

Conference2019 IEEE International Conference on Fuzzy Systems, FUZZ 2019
CountryUnited States
CityNew Orleans
Period23/06/1926/06/19

Bibliographical note

Funding Information:
The authors gratefully acknowledge the support of Hybrid-

Publisher Copyright:
© 2019 IEEE.

Copyright:
Copyright 2019 Elsevier B.V., All rights reserved.

Keywords

  • Cerber
  • Context-Triggered Piecewise Hashing
  • CryptoWall
  • CTPH
  • FCM
  • Fuzzy C-means Clustering
  • Fuzzy Hashing
  • Locky
  • Ransomware
  • SDHASH
  • Similarity Preserving
  • SSDEEP
  • Triaging
  • WannaCry
  • WannaCryptor

Fingerprint Dive into the research topics of 'Cyberthreat Hunting - Part 2: Tracking Ransomware Threat Actors using Fuzzy Hashing and Fuzzy C-Means Clustering'. Together they form a unique fingerprint.

Cite this