Abstract
Threat actors are constantly seeking new attack surfaces, with ransomeware being one the most successful attack vectors that have been used for financial g ain. T his has been achieved through the dispersion of unlimited polymorphic samples of ransomware whilst those responsible evade detection and hide their identity. Nonetheless, every ransomware threat actor adopts some similar style or uses some common patterns in their malicious code writing, which can be significant evidence contributing to their identification. T he fi rst st ep in attempting to identify the source of the attack is to cluster a large number of ransomware samples based on very little or no information about the samples, accordingly, their traits and signatures can be analysed and identified. T herefore, t his p aper p roposes an efficient fuzzy analysis approach to cluster ransomware samples based on the combination of two fuzzy techniques fuzzy hashing and fuzzy c-means (FCM) clustering. Unlike other clustering techniques, FCM can directly utilise similarity scores generated by a fuzzy hashing method and cluster them into similar groups without requiring additional transformational steps to obtain distance among objects for clustering. Thus, it reduces the computational overheads by utilising fuzzy similarity scores obtained at the time of initial triaging of whether the sample is known or unknown ransomware. The performance of the proposed fuzzy method is compared against k-means clustering and the two fuzzy hashing methods SSDEEP and SDHASH which are evaluated based on their FCM clustering results to understand how the similarity score affects the clustering results.
Original language | English |
---|---|
Title of host publication | 2019 IEEE International Conference on Fuzzy Systems, FUZZ 2019 |
Publisher | IEEE |
ISBN (Electronic) | 9781538617281 |
DOIs | |
Publication status | Published - 10 Oct 2019 |
Event | 2019 IEEE International Conference on Fuzzy Systems, FUZZ 2019 - New Orleans, United States Duration: 23 Jun 2019 → 26 Jun 2019 |
Publication series
Name | IEEE International Conference on Fuzzy Systems |
---|---|
Volume | 2019-June |
ISSN (Print) | 1098-7584 |
Conference
Conference | 2019 IEEE International Conference on Fuzzy Systems, FUZZ 2019 |
---|---|
Country/Territory | United States |
City | New Orleans |
Period | 23/06/19 → 26/06/19 |
Bibliographical note
Funding Information:The authors gratefully acknowledge the support of Hybrid-
Publisher Copyright:
© 2019 IEEE.
Copyright:
Copyright 2019 Elsevier B.V., All rights reserved.
Keywords
- Cerber
- Context-Triggered Piecewise Hashing
- CryptoWall
- CTPH
- FCM
- Fuzzy C-means Clustering
- Fuzzy Hashing
- Locky
- Ransomware
- SDHASH
- Similarity Preserving
- SSDEEP
- Triaging
- WannaCry
- WannaCryptor