.png){kind=icon}
返回
RTrap: Trapping and Containing Ransomware With Machine Learning
.png){kind=icon}
PRE
AI
DOI：10.1109/TIFS.2023.3240025.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
With advances in social engineering tricks and other technical shortcomings, ransomware attacks have become a severe cybercrime affecting organizations of all shapes and sizes. Although the security teams are making plenty of ransomware detection tools, the ransomware incident report shows they are ineffective in detecting emerging ransomware attacks. This work presents RTrap, a systematic framework to detect and contain ransomware efficiently and effectively via machine learning-generated deceptive files. Using a data-driven decoy file selection and generation strategy, RTrap plants deceptive decoy files across the directory to lure the ransomware to access it. RTrap also introduced a lightweight decoy watcher to monitor generated decoy files in real time. As the timing of the ransomware attack is not known to the victim in advance, and the ransomware encryption process is speedy, the proposed decoy-watcher executes an automatic/automated response after the detection promptly. The experiment shows that RTrap can detect ransomware with an average 18 file loss per 10311 legitimate user files.
Keyword:
Ransomware
Feature extraction
Cryptography
Codes
Organizations
Encryption
Behavioral sciences
Deception-based detection
ransomware detection
affinity propagation
machine learning
adaptive decoy files
期刊
IF:
8
论文数:
5.3K
被引数:
2.3W
机构
引用论文
Using Software-Defined Networking for Ransomware Mitigation: The Case of CryptoWall.png)
IEEE NETWORK
OAAI
IEEE NETWORKIF6.3
OAAI分享收藏R-Locker: Thwarting ransomware action through a honeyfile-based approachCOMPUTERS & SECURITYOAAI
COMPUTERS & SECURITYIF5.4
OAAI分享收藏
查看更多内容