Ransomware prevention using moving target defense based approach

Abstract

Over the past decade, there has been a rapidly rising trend of malware (ransomware) that limits user access by encrypting the data and demanding the ransom against the decryption key. In most cases, such encryption may lead to a permanent data loss. In order to prevent this unwanted encryption, we propose a method based on Moving Target Defense (MTD) approach. Our method is based on the alteration of the attack surface to reduce the attack success ratio. We have used multiple layers of MTD. The first layer generates random extensions that hide the existing known file extensions. This will protect user files against those ransomware variants which encrypt files having some specific extensions. Our second layer of protection uses event-based MTD in which tasks are scheduled to change file extensions at the occurrence of specific events which mostly occur due to the execution of ransomware in the system. As a result of our proposed method, we have successfully protected user files against well-known ransomware variants such as WannaCry,

Evaluating Large Language Models in Ransomware Negotiation: A Comparative Analysis of ChatGPT and Claude

“…These techniques focus on monitoring and analyzing behavioral patterns related to file access, changes, and unusual network activities, all of which are indicative of potential ransomware activity [43], [44]. With the increasing sophistication of ransomware attacks, researchers have integrated machine learning algorithms into detection systems, aiming to enhance their accuracy and adaptability [2], [15]. Machine learning models are trained on vast datasets of known ransomware behavior, enabling them to identify subtle patterns and anomalies that might elude traditional detection methods [45], [20], [46].…”

“…The occurrence of hallucinations and the variability in LLM performance in different scenarios highlight the limitations of AI in fully understanding the nuances of human communication and decision-making in complex situations [45], [1]. Human oversight in AI-driven ransomware negotiations can provide several benefits [10], [15]. It ensures that the responses and strategies generated by LLMs align with the organization's ethical standards and strategic goals [25], [66].…”

Ransomware Detection with Opcode Analysis and GAN-Based Unsupervised Learning

“…Ransomware's impact on different operating systems has also been extensively studied. While initially focusing on Windows systems, there has been a noticeable shift towards targeting other operating systems, including Linux and macOS, a shift demonstrates ransomware developers' response to changing market shares and user behaviors [23]. Another critical feature studied is the ransom payment mechanism, from simple anonymous payments to complex cryptocurrency transactions, primarily Bitcoin, which is indicative of the cybercriminals' efforts to maintain anonymity and reduce traceability [24].…”

NTFS+: An Enhanced NTFS File System Against Ransomware Invasions

“…Ransomware prevention encompasses an array of solutions, both technical and policy-oriented [11], [2], [8]. Technically, the development of endpoint security solutions, which integrate state-of-the-art threat prevention capabilities, play an instrumental role in thwarting the execution of ransomware attacks [9], [20], [36]. These solutions are adept at identifying and neutralizing potential threats before they can inflict damage [5], [10], [27].…”

“…This alarming trend underscores a shift in the mode of operation of ransomware attacks, evolving from mere nuisances to significant threats capable of crippling entire organizational operations [7], [8]. The impact of these attacks has been profound, with businesses and institutions facing not just financial losses due to the ransom payments but also significant operational disruptions and potential breaches of sensitive data [9], [1]. As such, the rise of ransomware represents a critical concern in cybersecurity, demanding rigorous and innovative defensive strategies to safeguard digital assets and maintain the integrity of computer systems [4].…”