Ransomware has becoming a current trend of cyberattack where its reputation among malware that cause a massive amount recovery in terms of cost and time for ransomware victims. Previous studies and solutions have showed that when it comes to malware detection, malware behavior need to be prioritized and analyzed in order to recognize malware attack pattern. Although the current state-of-art solutions and frameworks used dynamic analysis approach such as machine learning that provide more impact rather than static approach, but there is not any approachable way in representing the analysis especially a detection that relies on malware behavior. Therefore, this paper proposed a graph theory approach which is analysis of the ransomware behavior that can be visualized into graph-based pattern. An experiment has been conducted with ten ransomware samples for malware analysis and verified using VirusTotal. Then, file system among features were selected in the experiment as a medium to understand the behavior of ransomware using data capturing tools. After that, the result of the analysis was visualized in a graph pattern based on Neo4j which is graph database tool. By using graph as a base, the discussion has been made to recognize each type of ransomware that acts differently in the file system and analyze which node that have the most impact during analysis part.

Internet of things (IoT) is the things or devices with software, intelligent sensors interconnected via the internet to send and receive data with another device. This capacity makes things, i.e., smartphones, smart homes, intelligent toys, baby monitors, IP cameras, and many more to act as intelligent devices like artificial intelligence (AI) and be utilized in the everyday lifeworld widely. IoT has enormous expansion potential, and many challenges have been acknowledged but are still open today. The botnet is a collection of bots from IoT devices used to launch extensive network attacks. In addition, rapid growth in technology has led to an incomplete understanding of IoT. The increasing number of IoT devices has led to the spread of malware targeting IoT devices make IoT Botnet behaviors challenging to identify and determine. To detect these IoT Botnets, a preliminary experiment on flow analysis is necessary. This paper is to identify IoT Botnet attack patterns from the IoT Botnet behavior that get from IoT Botnet activities. Therefore, this research is to identify IoT Botnet attack patterns in a hostbased and network-based environment. First, this paper contributes to discovering, recognizing, categorizing, and detecting IoT Botnet activities. Next, organizing information to have a better understanding of the IoT botnet's problem and potential solutions. Then, construct the IoT Botnet attack pattern by analyzing the characteristics of the IoT Botnet behavior. This IoT Botnet attack pattern divides into two environments which are host-based and network-based. As a result, this paper aims to inform people about the attack pattern when the IoT device has been infected and become part of the botnet.