Ransomware Modeling Based on a Process Mining Approach
Publish place: International Journal of Information and Communication Technology Research (IJICT، Vol: 14، Issue: 3
Publish Year: 1401
نوع سند: مقاله ژورنالی
زبان: English
View: 131
This Paper With 9 Page And PDF Format Ready To Download
- Certificate
- من نویسنده این مقاله هستم
استخراج به نرم افزارهای پژوهشی:
شناسه ملی سند علمی:
JR_ITRC-14-3_004
تاریخ نمایه سازی: 1 آبان 1401
Abstract:
Ransomware attacks are taking advantage of the ongoing coronavirus pandemics and attacking the vulnerable systems in the health sector. Modeling ransomware attacks help to identify and simulate attacks against security environments, using likely adversary techniques. Process Mining (PM) is a field of study that focuses on analyzing process logs linked with the execution of the processes of a system to acquire insight into the variety of characteristics of how the functions behave. This paper presents a PM conformance-based approach to determining ransomware processes. First, frequent ransomware techniques were identified using state-of-the-art MITRE ATT&CK. Then, a model was developed to gather ransomware techniques using a process-based approach. The PM-based Prom tool is used to check the conformance of malware processes alongside the presented model to illustrate its efficiency. The model can identify chain processes associated with ransom-related behaviors. In this study, the presented model was evaluated using thirty common malwares in the healthcare industry. The approach demonstrates that this model could successfully classify ninety percent of malware instances as ransomware and non-ransomware. Finally, guidelines for future research are provided. We believe the proposed method will uncover behavioral models that will enable us to hunt ransomware threats.
Keywords:
Authors
Ebrahim Mahdipour
Department of Computer Engineering, Science and Research Branch, Islamic Azad University, Tehran, Iran
Ali Aghamohammadpour
Department of Computer Engineering, Science and Research Branch, Islamic Azad University, Tehran, Iran
Iman Attarzadeh
Department of Computer Engineering, Faculty of Engineering, Central Tehran Branch, Islamic Azad University, Tehran, Iran