WannaLaugh: A Configurable Ransomware Emulator -- Learning to Mimic Malicious Storage Traces
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2024
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866914833001086976 |
|---|---|
| author | Diamantopoulos, Dionysios Pletka, Roman Sarafijanovic, Slavisa Reddy, A. L. Narasimha Pozidis, Haris |
| author_facet | Diamantopoulos, Dionysios Pletka, Roman Sarafijanovic, Slavisa Reddy, A. L. Narasimha Pozidis, Haris |
| contents | Ransomware, a fearsome and rapidly evolving cybersecurity threat, continues to inflict severe consequences on individuals and organizations worldwide. Traditional detection methods, reliant on static signatures and application behavioral patterns, are challenged by the dynamic nature of these threats. This paper introduces three primary contributions to address this challenge. First, we introduce a ransomware emulator. This tool is designed to safely mimic ransomware attacks without causing actual harm or spreading malware, making it a unique solution for studying ransomware behavior. Second, we demonstrate how we use this emulator to create storage I/O traces. These traces are then utilized to train machine-learning models. Our results show that these models are effective in detecting ransomware, highlighting the practical application of our emulator in developing responsible cybersecurity tools. Third, we show how our emulator can be used to mimic the I/O behavior of existing ransomware thereby enabling safe trace collection. Both the emulator and its application represent significant steps forward in ransomware detection in the era of machine-learning-driven cybersecurity. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2403_07540 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | WannaLaugh: A Configurable Ransomware Emulator -- Learning to Mimic Malicious Storage Traces Diamantopoulos, Dionysios Pletka, Roman Sarafijanovic, Slavisa Reddy, A. L. Narasimha Pozidis, Haris Cryptography and Security Artificial Intelligence Ransomware, a fearsome and rapidly evolving cybersecurity threat, continues to inflict severe consequences on individuals and organizations worldwide. Traditional detection methods, reliant on static signatures and application behavioral patterns, are challenged by the dynamic nature of these threats. This paper introduces three primary contributions to address this challenge. First, we introduce a ransomware emulator. This tool is designed to safely mimic ransomware attacks without causing actual harm or spreading malware, making it a unique solution for studying ransomware behavior. Second, we demonstrate how we use this emulator to create storage I/O traces. These traces are then utilized to train machine-learning models. Our results show that these models are effective in detecting ransomware, highlighting the practical application of our emulator in developing responsible cybersecurity tools. Third, we show how our emulator can be used to mimic the I/O behavior of existing ransomware thereby enabling safe trace collection. Both the emulator and its application represent significant steps forward in ransomware detection in the era of machine-learning-driven cybersecurity. |
| title | WannaLaugh: A Configurable Ransomware Emulator -- Learning to Mimic Malicious Storage Traces |
| topic | Cryptography and Security Artificial Intelligence |
| url | https://arxiv.org/abs/2403.07540 |