ScienceDirect The 2 nd International Workshop on Future Information Security , Privacy & Forensics for Complex Systems ( FISP 2016 ) Experimental Analysis of Ransomware on Windows and Android Platforms : Evolution and Characterization
ScienceDirect The 2 nd International Workshop on Future Information Security , Privacy & Forensics for Complex Systems ( FISP 2016 ) Experimental Analysis of Ransomware on Windows and Android Platforms : Evolution and Characterization
复制标题
ScienceDirect 第二届未来信息安全、隐私国际研讨会
DOI：
--
复制
发表时间：
2016
期刊：
影响因子：
--
通讯作者：
Dale Lindskog
中科院分区：
文献类型：
--
作者：
P. Zavarsky;Dale Lindskog
本文的重点是通过分析Windows和Android环境中现有勒索软件家族中选定的勒索软件变体样本，提供有关勒索软件从开始到2016年3月如何演变的见解。分析了17个Windows和8个Android勒索软件家族。对于每个勒索软件家族，至少比较了属于同一家族的三个变体。分析显示，勒索软件变体的行为方式非常相似，但使用不同的有效载荷。我们的分析表明，勒索软件使用的加密技术有了显著的改进。在Windows环境下的实验结果表明，通过监测异常的文件系统和注册表活动，可以检测勒索软件。在Android环境中，我们的分析表明，通过密切关注Android应用程序请求的权限，可以降低勒索软件攻击的可能性。版权所有2016作者.由Elsevier B.V.出版，同行评审，由会议计划主席负责。
The focus of the paper is on providing insights on how ransomware have evolved from its starting till March 2016 by analyzing samples of selected ransomware variants from existing ransomware families in Windows and Android environments. Seventeen Windows and eight Android ransomware families were analyzed. For each ransomware family, at least, three variants belonging to the same family were compared. The analysis revealed that ransomware variants behave in a very similar manner, but use different payloads. Our analysis shows that there has been a significant improvement in encryption techniques used by ransomware. The experimental results in Windows environment demonstrate that detection of ransomware is possible by monitoring abnormal filesystem and registry activities. In Android environment, our analysis reveals that likelihood of ransomware attacks can be reduced by paying a closer attention to permissions requested by the Android applications. © 2016 The Authors. Published by Elsevier B.V. Peer-review under responsibility of the Conference Program Chairs.