论文标题
采用网络辅助方法进行有效勒索软件检测
Toward A Network-Assisted Approach for Effective Ransomware Detection
论文作者
论文摘要
勒索软件是一种使用加密机制来防止受害者正常使用计算机的恶意软件。结果，除非受害者向袭击者支付赎金，否则失去了对文件和台式机的访问。到2019年底，勒索软件袭击已向企业和个人造成了超过100亿美元的财务损失。在这项工作中，我们提出了包含有效的本地检测和网络级检测机制的网络辅助方法（NAA），以帮助用户确定机器是否已被勒索软件感染。为了评估其性能，我们在Docker中建造了100个容器，以模拟网络方案。接近现实世界勒索软件的混合勒索软件样本部署在受刺激性感染的机器上。实验结果表明，我们的网络级检测机制分别适用于WAN和LAN环境的勒索软件检测。
Ransomware is a kind of malware using cryptographic mechanisms to prevent victims from normal use of their computers. As a result, victims lose the access to their files and desktops unless they pay the ransom to the attackers. By the end of 2019, ransomware attack had caused more than 10 billion dollars of financial loss to enterprises and individuals. In this work, we propose Network-Assisted Approach (NAA), which contains effective local detection and network-level detection mechanisms, to help users determine whether a machine has been infected by ransomware. To evaluate its performance, we built 100 containers in Docker to simulate network scenarios. A hybrid ransomware sample which is close to real-world ransomware is deployed on stimulative infected machines. The experiment results show that our network-level detection mechanisms are separately applicable to WAN and LAN environments for ransomware detection.
