Know abnormal, find evil : frequent pattern mining for ransomware threat hunting and intelligence

Homayoun, S; Dehghantanha, A; Ahmadzadeh, M; Hashemi, S; Khayami, R

Abstract

Emergence of crypto-ransomware has significantly
changed the cyber threat landscape. A crypto ransomware
removes data custodian access by encrypting valuable data
on victims’ computers and requests a ransom payment to reinstantiate custodian access by decrypting data. Timely detection of ransomware very much depends on how quickly and
accurately system logs can be mined to hunt abnormalities and
stop the evil. In this paper we first setup an environment to
collect activity logs of 517 Locky ransomware samples, 535 Cerber
ransomware samples and 572 samples of TeslaCrypt ransomware.
We utilize Sequential Pattern Mining to find Maximal Frequent
Patterns (MFP) of activities within different ransomware families
as candidate features for classification using J48, Random Forest,
Bagging and MLP algorithms. We could achieve 99% accuracy
in detecting ransomware instances from goodware samples and
96.5% accuracy in detecting family of a given ransomware sample. Our results indicate usefulness and practicality of applying
pattern mining techniques in detection of good features for ransomware hunting. Moreover, we showed existence of distinctive
frequent patterns within different ransomware families which
can be used for identification of a ransomware sample family for
building intelligence about threat actors and threat profile of a
given target.

Citation

Homayoun, S., Dehghantanha, A., Ahmadzadeh, M., Hashemi, S., & Khayami, R. (2020). Know abnormal, find evil : frequent pattern mining for ransomware threat hunting and intelligence. IEEE Transactions on Emerging Topics in Computing, 8(2), 341-351. https://doi.org/10.1109/TETC.2017.2756908

• Journal Article Type: Article
• Acceptance Date: Sep 15, 2017
• Online Publication Date: Sep 26, 2017
• Publication Date: Jun 9, 2020
• Deposit Date: Nov 24, 2017
• Publicly Available Date: Nov 24, 2017
• Journal: IEEE Transactions on Emerging Topics in Computing
• Print ISSN: 2168-6750
• Electronic ISSN: 2168-6750
• Publisher: Institute of Electrical and Electronics Engineers
• Volume: 8
• Issue: 2
• Pages: 341-351
• DOI: https://doi.org/10.1109/TETC.2017.2756908
• Publisher URL: http://dx.doi.org/10.1109/TETC.2017.2756908
• Related Public URLs: http://ieeexplore.ieee.org/xpl/RecentIssue.jsp?punumber=6245516
• Additional Information: Access Information : Version of record available from IEEE Transactions on Emerging Topics in Computing at Official URL above