Ransomware Behavior Attack Construction via Graph Theory Approach

Abstract

Ransomware has becoming a current trend of cyberattack where its reputation among malware that cause a massive amount recovery in terms of cost and time for ransomware victims. Previous studies and solutions have showed that when it comes to malware detection, malware behavior need to be prioritized and analyzed in order to recognize malware attack pattern. Although the current state-of-art solutions and frameworks used dynamic analysis approach such as machine learning that provide more impact rather than static approach, but there is not any approachable way in representing the analysis especially a detection that relies on malware behavior. Therefore, this paper proposed a graph theory approach which is analysis of the ransomware behavior that can be visualized into graph-based pattern. An experiment has been conducted with ten ransomware samples for malware analysis and verified using VirusTotal. Then, file system among features were selected in the experiment as a medium to understand the behavior of ransomware using data capturing tools. After that, the result of the analysis was visualized in a graph pattern based on Neo4j which is graph database tool. By using graph as a base, the discussion has been made to recognize each type of ransomware that acts differently in the file system and analyze which node that have the most impact during analysis part.

Entropy and Memory Forensics in Ransomware Analysis: Utilizing LLaMA-7B for Advanced Pattern Recognition

“…Such a shift has introduced a new generation of ransomware threats, which have raised considerable concerns regarding the safeguarding of information privacy and the security of organizations at large [8], [9]. The transition from reliance on encryption to strategies that emphasize exfiltration has compelled a thorough reassessment of the defensive tactics and analytical methodologies traditionally employed [10], [11]. Within this context, memory forensics has come to the forefront as a formidable instrument in the ongoing struggle against ransomware, providing researchers with the means to examine these threats within their operational environment and extract valuable insights from the behaviors they exhibit while active [6], [12].…”

“…Although the outcomes of the study have been encouraging, it has concurrently illuminated the complex challenges faced when contending with sophisticated ransomware. The capacity for adaptation and the elusive nature of contemporary ransomware strains have demanded ongoing progress in the realms of detection and analytical methodologies [10], [4]. The dependence on methods such as pattern recognition and analysis of memory, while they have proved to be beneficial, might not be entirely reliable against ransomware that is continuously evolving to bypass these particular detection strategies [36].…”

A Conceptual Learning Framework of Cybersecurity Education for Military and Law Enforcement

“…In this approach, the ransomware behaviors are analyzed and visualized in a graph-based pattern via Neo4j, a graph database tool. It is possible to recognize the type of ransomware and most impactful graph base node during the analysis (Rosli et al, 2020). Ding et al (2018) implemented the graphbased method to detect malware, particularly the behavior matching algorithm of the maximum weight subgraph.…”

Early Detection of Windows Cryptographic Ransomware Based on Pre-Attack API Calls Features and Machine Learning

“…The payment for the ransom must be made using a cryptocurrency transaction. The encrypted data cannot be decrypted unless the attacker provides the encryption key [27,28]. Two varieties of ransomware exist locker and cryptographic.…”