Connection-monitor &amp; connection-breaker: A novel approach for prevention and detection of high survivable ransomwares

Ahmadian, Mohammad; Shahriari, Hamid Reza; Ghaffarian, Seyed Mohammad

doi:10.1109/iscisc.2015.7387902

Cited by 58 publications

(56 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Ahmadian et al [23] present an approach for detecting and preventing highly survivable ransomware based on a principal feature discovered in the taxonomy. The focus of their work is to provide data resilience via monitoring and preventing the encryption of the victim's data.…”

Section: Related Workmentioning

confidence: 99%

Towards Data Resilience: The Analytical Case of Crypto Ransomware Data Recovery Techniques

Zimba¹,

Wang²,

Simukonda³

2018

IJITCS

View full text Add to dashboard Cite

Abstract-Crypto ransomware has earned an infamous reputation in the malware landscape and its sound sends a lot of shivers to many despite being a new entrant. The media has not helped matters even as the myths and inaccuracies surrounding crypto ransomware continue to deepen. It's been purported that once crypto ransomware attacks, the victim is left with no option but to pay in order to retrieve the encrypted data, and that without a guarantee, or risk losing the data forever. Security researchers are inadvertently thrown into a cat-and-mouse chase to catch up with the latest vices of the aforesaid in order to provide data resilience. In this paper, we debunk the myths surrounding loss of data via a crypto ransomware attack. Using a variety of crypto ransomware samples, we employ reverse engineering and dynamic analysis to evaluate the underlying attack structures and data deletion techniques employed by the ransomware. Further, we expose the data deletion techniques used by ransomware to prevent data recovery and suggest how such could be countered. From the results, we further present observed sandbox evasion techniques employed by ransomware against both static and dynamic analysis in an effort to obfuscate its operations and subsequently prevent data recovery. Our analyses have led us to the conclusion that no matter how devastating a crypto ransomware attack might appear, the key to data recovery options lies in the underlying attack structure and the implemented data deletion methodology.

show abstract

Section: Related Workmentioning

confidence: 99%

Towards Data Resilience: The Analytical Case of Crypto Ransomware Data Recovery Techniques

Zimba¹,

Wang²,

Simukonda³

2018

IJITCS

View full text Add to dashboard Cite

show abstract

“…8 According to Kaspersky, when it is operated in the manner above, ransomware is exceedingly dangerous because the encrypted files cannot be recovered. The first step is seeking out the victim, for which ransomware writers propagate their ransomware using spam mail or other propagation methods.…”

Section: Name Descriptionmentioning

confidence: 99%

“…12 CryptorBit This ransomware emerged in 2013, and it encrypts the first 512 bytes of a file based on polyalphabetic substitution. 8 Trojan. Win32.Filecode This ransomware performs encryption based on private key-based cryptographic algorithm.…”

Section: Gpcodermentioning

confidence: 99%

“…The last step is the display of the message demanding payment that is either a stored text file or is displayed on the victim's screen. 8 According to Kaspersky, when it is operated in the manner above, ransomware is exceedingly dangerous because the encrypted files cannot be recovered. 6 Therefore, numerous researchers have engaged in studies to counteract ransomware threats, and the surveyed results of previous countermeasures are subsequently described.…”

Section: Name Descriptionmentioning

confidence: 99%

“…On the other hand, encrypted files or systems are difficult to recover even with the sharing of the key when ransomware writers distribute group keys. 8 To solve these problems, we proposed a ransomware prevention technique using key backup.…”

Section: Proposed Prevention Techniquementioning

confidence: 99%

See 2 more Smart Citations

Ransomware prevention technique using key backup

Lee

Yim

Seo

2017

Concurrency and Computation

View full text Add to dashboard Cite

In this paper, a key backup technique for the recovery of files encrypted by ransomware is proposed. Ransomware interferes with the victim's system through abnormal behavior such as locking of the victim's system or encryption of the system or files. Ransomware writers demand money from the victims as a condition for the recovery of the encrypted files and systems that have been seized; systems infected by ransomware cannot be repaired without a decryption key, making the employment of detection and recovery methods urgent. This paper proposes a prevention technique for backing up encryption keys in a secure repository which enables the recovery of ransomware-infected systems and ransomware-encrypted files. The proposed technique can be used to repair systems infected by ransomware, thereby ensuring safety against such malicious codes. KEYWORDSbig data security, key backup, prevention, ransomware INTRODUCTIONAs modern society is changing into an information society, various kinds of corresponding information are utilized and stored. In the past, users stored their personal information in storage media such as hard disks, floppy disks, and CDs. While the computing environment and the network environment continually develop, remote storage technologies such as web hard drives and cloud services-wherein data and the computing environment such as software are used remotely-have emerged. With the development of the storage environment, the remote techniques are able to process mass data, and big data has emerged as a result. Big data is the derivation of value of data through the collection, storage, management, and analysis of mass data.Similar to other research fields, the most important element of big data is the data itself. In this respect, the analyzed results are valuable when data must be preserved without the need for alteration; unfortunately, though, there is a problem regarding ensuring the reliability of the data. Because many problems are caused by forged data, a critical issue is the vulnerability of the system data that are stored, and a representative example is cyber-crime. Past cyber-crimes originated from curiosity but have developed into a tool for revenge, monetary purposes, and cyber warfare, and cyber-crime has become a kind of service called "CaaS" (crime as a service). 1 These services are being sold as products and are classified according to consulting services: botnet setups, infection and spreading services, botnet and rentals, and crimeware-upgrade modules. Concretely, a consulting service for a typical botnet setup is approximately 350 to 400 dollars, whereas an infection and spreading service is approximately 100 dollars for every 1000 installed. Therefore, big data systems comprising part of the various service-related data have been exposed to threats, and the salience of this issue is further highlighted by the recent emergence of ransomware. In February 2016, one of the most notorious ransomware attacks occurred; because of this, Hollywood Presbyterian Medical Center in the US was ...

show abstract