Ransomware Behavior Attack Construction via Graph Theory Approach
| Autor: | Muhammad Safwan Rosli, Faizal M.A, Raihana Syahirah Abdullah, Wan Nur Fatihah Wan Mohd Zaki, Warusia Yassin |
|---|---|
| Rok vydání: | 2020 |
| Předmět: |
File system
021110 strategic defence & security studies Graph database General Computer Science Computer science 0211 other engineering and technologies 020206 networking & telecommunications Graph theory 02 engineering and technology computer.software_genre 0202 electrical engineering electronic engineering information engineering Ransomware Graph (abstract data type) Malware Data mining Malware analysis computer |
| Zdroj: | International Journal of Advanced Computer Science and Applications. 11 |
| ISSN: | 2156-5570 2158-107X |
| DOI: | 10.14569/ijacsa.2020.0110262 |
| Popis: | Ransomware has becoming a current trend of cyberattack where its reputation among malware that cause a massive amount recovery in terms of cost and time for ransomware victims. Previous studies and solutions have showed that when it comes to malware detection, malware behavior need to be prioritized and analyzed in order to recognize malware attack pattern. Although the current state-of-art solutions and frameworks used dynamic analysis approach such as machine learning that provide more impact rather than static approach, but there is not any approachable way in representing the analysis especially a detection that relies on malware behavior. Therefore, this paper proposed a graph theory approach which is analysis of the ransomware behavior that can be visualized into graph-based pattern. An experiment has been conducted with ten ransomware samples for malware analysis and verified using VirusTotal. Then, file system among features were selected in the experiment as a medium to understand the behavior of ransomware using data capturing tools. After that, the result of the analysis was visualized in a graph pattern based on Neo4j which is graph database tool. By using graph as a base, the discussion has been made to recognize each type of ransomware that acts differently in the file system and analyze which node that have the most impact during analysis part. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|