랜섬웨어의 파일 접근 순서 정보를 활용한 허니팟 기반 랜섬웨어 탐지 및 방어 기법
Honeypot-based ransomware detection and defense method using file access order information
2
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
랜섬웨어는 시스템을 사용 불가능한 상태로 만들거나 데이터를 암호화하여 접근 불가능한 상태로 만든 후 금전을 요구하는 악성 소프트웨어이다. 랜섬웨어로 인한 피해 규모는 시간이 지날수록 커지고 있으며, 그 종류 또한 해가 갈수록 더욱 다양해지고 있다. 그에 따라 현재까지 다양한 방어기법이 연구되었으며 이후로도 더욱 다양한 방어기법의 연구가 요구되고 있다. 본 논문에서는 기존의 허니팟 기반 방법에 윈도우 이벤트 로그 분석을 결합하여 랜섬웨어의 활동을 신속히 식별하고 차단하는 방법을 제안한다. 또한, 랜섬웨어마다 암호화를 진행하기 위해 접근하는 파일의 순서에 대한 패턴들이 있다는 점을 활용해, 랜섬웨어의 탐지 및 종료 시간을 단축시키는 방법을 제안한다. 다양한 랜섬웨어 샘플에 대해 실험을 진행한 결과, 제안한 기법이 랜섬웨어를 신속하게 탐지하고 종료시킬 수 있음을 확인하였다.
Abstract
Ransomware is a malicious software that demands money after making a system unusable or blocking the user's access by encrypting data. The scale of damage caused by ransomware is increasing over time, and its types are also becoming more diverse as the years go by. Various defense techniques have been studied so far, and more extensive research on them is required. In this paper, we propose a new method for ransomware detection and defense by combining window event log analysis with the previous Honeypot-based technique. In addition, we propose a method to shorten the time for detection and termination of ransomware by using the patterns on the order of files accessed by ransomware to proceed with encryption. The experimental results with various ransomware samples demonstrate that the proposed method can detect and terminate ransomware.
참고문헌 (27)
- Kim, S. M., "Ransomware detection and defence techniques using honeypot techniques and Windows event log analysis", 2024 Spring Conference of the Korean Institute of Next Generation Computing, pp.1~4 (2024)
- "Ransomware Damage Reduction... "The reason is 'refusal to pay for the body'" (2023)[URL]
- Ransomware Trends Report for Q2 2022, "Korea Internet & Security Agency", 6~ (2022)
- Ransomware Trends Report for Q3 2023, "Korea Internet & Security Agency", 5~ (2023)
- Lu, T., "Ransomware Detection based on V-detector Negative Selection Algorithm", Proceedings of the 2017 International Conference on Security, Pattern Analysis, and Cybernetics(SPAC), pp.531~536 (2017)
- Hampton, N., "Ransomware Behavioural Analysis on Windows Platforms", Journal of Information Security and Applications, 40, pp.44~51 (2018)
- Azmoodeh, Amin, "Detecting cryptoransomware in IoT networks based on energy consumption footprint", Journal of Ambient Intelligence and Humanized Computing, 9(4), pp.1141~1152 (2018)
- Kolodenker, E., "PayBreak : Defense against Cryptographic Ransomware", Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, pp.599~611 (2017)
- Sheen, S., "Ransomware detection by mining API call usage", 2018 International Conference on Advances in Computing, Communications and Informatics (ICACCI), pp.983~987 (2018)
- El-Kosairy, Ahmed, "Intrusion and Ransomware Detection System", IEEE, Proceedings of the 1st International Conference on Computer Applications &Information Security (ICCAIS’18), pp.1~7 (2018)
- Moore, Chris, "Detecting ransomware with honeypot techniques", IEEE, Proceedings of the Cybersecurity and Cyberforensics Conference (CCC’16), pp.77~81 (2016)
- Lee, Jeonghwan, "How to make efficient decoy files for ransomware detection?", ACM, Proceedings of the International Conference on Research in Adaptive and Convergent Systems, pp.208~212 (2017)
- Kang, S., "Study on Windows Event Log-Based Corporate Security Audit and Malware Detection", Journal of the Korea Institute of Information Security & Cryptology, 28(3), pp.591~603 (2018)
- "Event 4663"[URL]
- "Event Tracing"[URL]
- "OpenTraceA"[URL]
- SK Shieldus, "EQST INSIGHT September 2023 issue", 9~10 (2023)
- LockBit 3.0 Rasomware, "SOMANSA", ~ (2023)
- "#StopRansomware: MedusaLocker"[URL]
- Conti Ransomware Encryption Feature Analysis Report, "Korea Internet & Security Agency", ~ (2022)
- "Phobos ransomware caution circulating over vulnerable RDP"[URL]
- Ransomware Trends Report for Q4 2022, "Korea Internet & Security Agency", 20~ (2023)
- "BlueCrab ransomware constantly trying to bypass detection"[URL]
- Global Information Assurance Certification Paper, "Ibrahim Gomaa", SANS Institute, ~ (2011)
- LockBit 3.0 Ransomware Encryption Feature Analysis Report, "Korea Internet & Security Agency", ~ (2023)
- Phobos Ransomware Encryption Feature Analysis Report, "Korea Internet & Security Agency", ~ (2019)
- Wira, Z., "Ransomware Behavior on Windows Endpoint : An Analysis", Journal of Social Science and Humanities, 6(5), pp.25~31 (2023)