Critical Analysis of Ransomware in Relation to Cybercrime

Ransomware attacks are not a new idea, but their prevalence has risen dramatically in recent times. A key explanation for this is the financial compensation that the perpetrator stands to gain, as well as the fact that crypto-currency allows for anonymous transactions. Initially a single-host menace, ransomware is rapidly developing to conduct more sophisticated attacks by spreading through a network of hosts. One of the most difficult aspects of defending from these attacks is that every ransomware caucus is always evolving, rendering individual samples unidentifiable. Common signature-based countermeasures, such as those used to fight viruses, are made ineffective as a result. Furthermore, attempting to reverse engineer each sample in order to develop successful countermeasures or solutions is an expensive venture. Much more so now that ransomware writers are beginning to use complicated methods ensuring that getting to the original source code more difficult.

The researcher believes that a more general detection approach can be used to find a solution. It should be focused on the traits that all ransomware families share. This should help to shift the focus of research from samples to families. I collect meta-data about the files that are read and written during ransomware attacks using easy and fast metrics and applied a qualitative mode of data collection. These attacks have a common pattern of attempting to encrypt all of the victims' data. Encrypted files have a significant increase in entropy while the data size remains relatively unchanged. These characteristics can also be seen in normal user behaviour, such as when a user encrypts a file. As a result, we must allow encryption while also imposing a frequency limit to ensure that regular user traffic does not result in false positives.

Inhaltsverzeichnis (Table of Contents)

• 0.0 ABSTRACT
• 1.0 INTRODUCTION
• 2.0 LITERATURE REVIEW
• 3.0 UNDERSTANDING RANSOMWARE
  • 3.1 Evolution of Ransomware
  • 3.2 Ransomware comes in a variety of forms
  • 3.3 Phases of Ransomware
  • 3.4 An attack channel for ransomware
  • 3.5 The Ransomware Process
• 4.0 Research Question
  • 4.1 Is it possible to detect ransomware on a network that is using the samba protocol?
• 5.0 METHODOLOGY
  • 5.1 Sampling method
• 6.0 RESEARCH FINDINGS
  • 6.1 Dependability and validity
• 7.0 DISCUSSION
• 8.1 Preventive Measures
• 8.2 Email etiquette
• 8.3 Advanced monitoring and recognition
• 8.4 Disaster recovery and backups

Zielsetzung und Themenschwerpunkte (Objectives and Key Themes)

This dissertation aims to develop a method for detecting ransomware attacks by focusing on the communication patterns it generates. The research specifically targets ransomware that encrypts files stored on network repositories. The primary objective is to create a solution capable of detecting diverse ransomware families.

• Evolution and Prevalence of Ransomware
• Understanding Ransomware Techniques and Processes
• Developing a Detection Method Based on Communication Patterns
• Evaluating the Effectiveness of the Proposed Detection Method
• Exploring Preventive Measures Against Ransomware Attacks

Zusammenfassung der Kapitel (Chapter Summaries)

• Chapter 1.0 INTRODUCTION: This chapter provides an overview of cybercrime, highlighting its evolution and impact in the Information Age. It explores the history and characteristics of malicious software and the challenges posed by ransomware attacks.
• Chapter 2.0 LITERATURE REVIEW: This chapter will present a comprehensive review of existing research on ransomware, covering various aspects like its evolution, techniques, and countermeasures.
• Chapter 3.0 UNDERSTANDING RANSOMWARE: This chapter provides a detailed understanding of ransomware, its different forms, and the phases involved in a typical ransomware attack. It also analyzes the attack channels used by ransomware and the intricate processes involved in executing a successful attack.
• Chapter 4.0 Research Question: This chapter focuses on the specific research question of this study, investigating the feasibility of detecting ransomware on a network using the Samba protocol.
• Chapter 5.0 METHODOLOGY: This chapter outlines the research methodology employed in the study, including the specific sampling method used to collect data.
• Chapter 6.0 RESEARCH FINDINGS: This chapter presents the findings of the research, focusing on the data collected and analyzed. It includes discussions on the dependability and validity of the research results.
• Chapter 7.0 DISCUSSION: This chapter analyzes the research findings in depth, exploring their implications and discussing potential applications for the developed detection method.
• Chapter 8.1 Preventive Measures: This chapter discusses various preventive measures that can be implemented to mitigate the risk of ransomware attacks.
• Chapter 8.2 Email etiquette: This chapter explores the role of email etiquette in preventing ransomware attacks, highlighting best practices for users.
• Chapter 8.3 Advanced monitoring and recognition: This chapter examines advanced monitoring and recognition techniques that can be used to identify and prevent ransomware attacks.
• Chapter 8.4 Disaster recovery and backups: This chapter emphasizes the importance of disaster recovery and backups as a crucial aspect of ransomware mitigation.

Schlüsselwörter (Keywords)

This research delves into the realm of ransomware, focusing on its detection and prevention. Key themes include the evolution of ransomware, its attack techniques and communication patterns, the development of a novel detection method, and the importance of preventive measures such as email etiquette, advanced monitoring, and disaster recovery.

Details

• Note: A
• Autor: Rhoda Kariuki (Autor:in)
• Erscheinungsjahr: 2023
• Seiten: 36
• Katalognummer: V1375124
• ISBN (eBook): 9783346911612
• ISBN (Buch): 9783346911629
• Sprache: Englisch
• Schlagworte: critical analysis ransomware relation cybercrime