Ransomware,particularly crypto-ransomware,remains a significant cybersecurity challenge,encrypting victim data and demanding a ransom,often leaving the data irretrievable even if payment is made.This study proposes an...Ransomware,particularly crypto-ransomware,remains a significant cybersecurity challenge,encrypting victim data and demanding a ransom,often leaving the data irretrievable even if payment is made.This study proposes an early detection approach to mitigate such threats by identifying ransomware activity before the encryption process begins.The approach employs a two-tiered approach:a signature-based method using hashing techniques to match known threats and a dynamic behavior-based analysis leveraging Cuckoo Sandbox and machine learning algorithms.A critical feature is the integration of the most effective Application Programming Interface call monitoring,which analyzes system-level interactions such as file encryption,key generation,and registry modifications.This enables the detection of both known and zero-day ransomware variants,overcoming limitations of traditional methods.The proposed technique was evaluated using classifiers such as Random Forest,Support Vector Machine,and K-Nearest Neighbors,achieving a detection accuracy of 98%based on 26 key ransomware attributes with an 80:20 training-to-testing ratio and 10-fold cross-validation.By combining minimal feature sets with robust behavioral analysis,the proposed method outperforms existing solutions and addresses current challenges in ransomware detection,thereby enhancing cybersecurity resilience.展开更多
软件定义网络(software defined networking,简称SDN)初步实现了网络控制面与数据面分离的思想,然而在提供高度开放性和可编程性的同时,网络自身也面临着诸多安全问题,从而限制了SDN在很多场景下的大规模部署和应用.首先对SDN的架构和...软件定义网络(software defined networking,简称SDN)初步实现了网络控制面与数据面分离的思想,然而在提供高度开放性和可编程性的同时,网络自身也面临着诸多安全问题,从而限制了SDN在很多场景下的大规模部署和应用.首先对SDN的架构和安全模型进行分析;其次,从"SDN特有/非特有的典型安全问题"和"SDN各层/接口面临的安全威胁"两方面,对SDN中存在的典型安全威胁和安全问题进行分析和归纳;随后从6个方面对现有SDN安全问题的主要解决思路及其最新研究进展分别进行探讨,包括SDN安全控制器的开发、控制器可组合安全模块库的开发和部署、控制器Do S/DDo S攻击防御方法、流规则的合法性和一致性检测、北向接口的安全性和应用程序安全性;最后对SDN安全方面的标准化工作进行了简要分析,并对SDN安全方面未来的研究趋势进行了展望.展开更多
基金funded by the National University of Sciences and Technology(NUST)supported by the Basic Science Research Program through the National Research Foundation of Korea(NRF),funded by the Ministry of Education(2021R1IIA3049788).
文摘Ransomware,particularly crypto-ransomware,remains a significant cybersecurity challenge,encrypting victim data and demanding a ransom,often leaving the data irretrievable even if payment is made.This study proposes an early detection approach to mitigate such threats by identifying ransomware activity before the encryption process begins.The approach employs a two-tiered approach:a signature-based method using hashing techniques to match known threats and a dynamic behavior-based analysis leveraging Cuckoo Sandbox and machine learning algorithms.A critical feature is the integration of the most effective Application Programming Interface call monitoring,which analyzes system-level interactions such as file encryption,key generation,and registry modifications.This enables the detection of both known and zero-day ransomware variants,overcoming limitations of traditional methods.The proposed technique was evaluated using classifiers such as Random Forest,Support Vector Machine,and K-Nearest Neighbors,achieving a detection accuracy of 98%based on 26 key ransomware attributes with an 80:20 training-to-testing ratio and 10-fold cross-validation.By combining minimal feature sets with robust behavioral analysis,the proposed method outperforms existing solutions and addresses current challenges in ransomware detection,thereby enhancing cybersecurity resilience.
文摘软件定义网络(software defined networking,简称SDN)初步实现了网络控制面与数据面分离的思想,然而在提供高度开放性和可编程性的同时,网络自身也面临着诸多安全问题,从而限制了SDN在很多场景下的大规模部署和应用.首先对SDN的架构和安全模型进行分析;其次,从"SDN特有/非特有的典型安全问题"和"SDN各层/接口面临的安全威胁"两方面,对SDN中存在的典型安全威胁和安全问题进行分析和归纳;随后从6个方面对现有SDN安全问题的主要解决思路及其最新研究进展分别进行探讨,包括SDN安全控制器的开发、控制器可组合安全模块库的开发和部署、控制器Do S/DDo S攻击防御方法、流规则的合法性和一致性检测、北向接口的安全性和应用程序安全性;最后对SDN安全方面的标准化工作进行了简要分析,并对SDN安全方面未来的研究趋势进行了展望.
