R-Locker: Thwarting ransomware action through a honeyfile-based approach

Gómez-Hernández, José Antonio; Álvarez-González, L.; García-Teodoro, Pedro

doi:10.1016/j.cose.2017.11.019

Cited by 122 publications

(75 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Gomez Hernandez et al illustrate in their work (RLocker) a ransomware early detection mechanism that could prevent its operations [20]. One of RLocker advantages is the detection of zero day's ransomware attacks.…”

Section: Host Based Ransomware Detectionmentioning

confidence: 99%

Ransomware Network Traffic Analysis for Pre-encryption Alert

Moussaileb

Cuppens

Lanet³

et al. 2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Cyber Security researchers are in an ongoing battle against ransomware attacks. Some exploits begin with social engineering methods to install payloads on victims' computers, followed by a communication with command and control servers for data exchange. To scale down these attacks, scientists should shed light on the danger of those rising intrusions to prevent permanent data loss. To join this arm race against malware, we propose in this paper an analysis of various ransomware families based on the collected system and network logs from a computer. We delve into malicious network traffic generated by these samples to perform a packet level detection. Our goal is to reconstruct ransomware's full activity to check if its network communication is distinguishable from benign traffic. Then, we examine if the first packet sent occurs before data's encryption to alert the administrators or afterwards. We aim to define the first occurrence of the alert raised by malicious network traffic and where it takes place in a ransomware workflow. Logs collected are available at http://serveur2.seres.rennes.telecom-bretagne.eu/data/RansomwareData/.

show abstract

Section: Host Based Ransomware Detectionmentioning

confidence: 99%

Ransomware Network Traffic Analysis for Pre-encryption Alert

Moussaileb

Cuppens

Lanet³

et al. 2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…lately, some authors have developed further prevention methods. Gómez-Hernández et al [33] proposed a general methodology called R-Locker to thwart crypto ransomware actions. It is based on the deployment of a honey file design of the Linux system to block the ransomware when it accesses a canary file, thus allowing it to maintain the rest of the data.…”

Section: Trapping Attackermentioning

confidence: 99%

Ransomware Prevention and Mitigation Techniques

Alshaikh¹,

Ramadan²,

Ahmed³

2020

IJCA

View full text Add to dashboard Cite

Ransomware is a malware family that using security techniques such as cryptography to hijacking user files and associated resources and requests cryptocurrency in exchange for the locked data. There is no limit to who can be targeted by ransomware since it can be transmitted over the internet. Like traditional malware, ransomware may enter the system utilizing "social engineering, malware advertising, spam emails, take advantage of vulnerabilities, drive-by downloads or through open ports or by utilizing back doors". But in contrast to traditional malware, even after removal, ransomware influence is irreparable and tough to alleviate its impact without its creator assistance. This kind of attack has a straightforward financial implication, which is fueled by encryption technology, cyber currency. Therefore, ransomware has turned into a profitable business that has obtained rising popularity between attackers. As stated by "Cybersecurity Ventures", ransomware is the quickest increasing type of cybercrime. Since, global ransomware wastage expense is predicted to hit $20 billion in 2021, up from just $325 million in 2015 which, is 57X extra in 2021. In this paper, a brief of the recent research in the prevention of ransomware attacks and the best practices to mitigate the attack impact is presented. General TermsRansomware prevention technique, ransomware mitigation technique, signature-based, behavior-based.

show abstract

“…The entropy regulation terms in (10) and (11) result in a closed form of strategies and learning dynamics in (13). Without the closed form, distributed learners can adopt general learning schemes which combine the payoff and the strategy update as stated in [46].…”

Section: Heterogeneous and Hybrid Learningmentioning

confidence: 99%

Strategic Learning for Active, Adaptive, and Autonomous Cyber Defense

Huang

Zhu

2020

Adaptive Autonomous Secure Cyber Systems

View full text Add to dashboard Cite

The increasing instances of advanced attacks call for a new defense paradigm that is active, autonomous, and adaptive, named as the '3A' defense paradigm. This chapter introduces three defense schemes that actively interact with attackers to increase the attack cost and gather threat information, i.e., defensive deception for detection and counter-deception, feedback-driven Moving Target Defense (MTD), and adaptive honeypot engagement. Due to the cyber deception, external noise, and the absent knowledge of the other players' behaviors and goals, these schemes possess three progressive levels of information restrictions, i.e., from the parameter uncertainty, the payoff uncertainty, to the environmental uncertainty. To estimate the unknown and reduce the uncertainty, we adopt three different strategic learning schemes that fit the associated information restrictions. All three learning schemes share the same feedback structure of sensation, estimation, and actions so that the most rewarding policies get reinforced and converge to the optimal ones in autonomous and adaptive fashions. This work aims to shed lights on proactive defense strategies, lay a solid foundation for strategic learning under incomplete information, and quantify the tradeoff between the security and costs.Recent instances of WannaCry ransomware, Petya cyberattack, and Stuxnet malware have demonstrated the trends of modern attacks and the corresponding new security challenges as follows.

show abstract

R-Locker: Thwarting ransomware action through a honeyfile-based approach

Cited by 122 publications

References 14 publications

Ransomware Network Traffic Analysis for Pre-encryption Alert

Ransomware Network Traffic Analysis for Pre-encryption Alert

Ransomware Prevention and Mitigation Techniques

Strategic Learning for Active, Adaptive, and Autonomous Cyber Defense

Contact Info

Product

Resources

About