No abstract

Ransomware is a type of advanced malware that has spread rapidly in recent years, causing significant financial losses for a wide range of victims, including organizations, healthcare facilities, and individuals. Modern host-based detection methods require the host to be infected first in order to identify anomalies and detect the malware. By the time of infection, it can be too late as some of the system's assets would have been already exfiltrated or encrypted by the malware. Conversely, the network-based methods can be effective in detecting ransomware attacks, as most ransomware families try to connect to command and control servers before their harmful payloads are executed. Therefore, a careful analysis of ransomware network traffic can be one of the key means for early detection. This paper demonstrates a comprehensive behavioral analysis of crypto ransomware network activities, taking Locky, one of the most serious families, as a case study. A dedicated testbed was built, and a set of valuable and informative network features were extracted and classified into multiple types. A network-based intrusion detection system was implemented, employing two independent classifiers working in parallel on different levels: packet and flow levels. The experimental evaluation of the proposed detection system demonstrates that it offers high detection accuracy, low false positive rate, valid extracted features, and is highly effective in tracking ransomware network activities.

Cybercrime has long since transformed from a world of Maverick attackers to a criminal business. Ransomware is a malware that renders a victim's computer or data unusable and is increasingly being used by criminals to generate revenue through extortion. This study contributes to the authors' knowledge by exploring the transition from the early-day scams, to extortion implemented by current ransomware. They examine the pathway from the first clumsy ransomware attempts to the present day sophisticated ransomware attack campaigns. This Crypto-warfare now accounts for estimated damages of $1 billion. Considering the fact that many Internet users appear to be unaware of ransomware and do little to protect themselves, they argue that this low-impact extortion, using highly automated methods, has proven very rewarding for the criminals. As criminals have been early adopters (or abusers) of Internet technology, they expect that ransomware will continue to evolve beyond the capability of present day defence solutions.

Obfuscation is a strategy employed by malware writers to camouflage the telltale signs of malware and thereby undermine anti-malware software and make malware analysis difficult for anti-malware researchers. This paper investigates the use of supervised learning machines to identify malware and investigates the problems of feature identification and feature reduction. We present several methods of filtering features in the temporal domain prior to applying the reduced feature set to the learning machines. The findings have identified several methods of feature reduction and are presented their viability as filters are assessed.

From driverless cars to propertyless rental companies, nowadays '-less' is more. Traditional maliciousware attacks is following this trendhave evolved beyond file-based methods, with malicious files now existing as processes and services in order to evade detection. This article examines the rise of cryptojacking-the use of another's machine for profit through cryptocurrency mining, and how we're all at risk.