Efficient detection and neutralization of ransomware

有效检测和消除勒索软件

• 批准号: 500882-2016
• 负责人: Adams, Carlisle
• 金额: $ 1.82万
• 依托单位: University of Ottawa
• 依托单位国家: 加拿大
• 项目类别: Engage Grants Program
• 财政年份: 2016
• 资助国家: 加拿大
• 起止时间: 2016-01-01 至 2017-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=608347
• 关键词: Efficient; detection; neutralization; ransomware

An increasingly important category of malware in recent years is ransomware, which is a type of malware that prevents data and systems from being accessed by their owners (often using locking or encryption mechanisms) and requires victims to pay a ransom to the attacker in order to regain access. For some simple forms of ransomware it is possible to find the key and decrypt the encrypted user files (so that the victim does not have to pay the ransom to the attacker), but other forms of ransomware are significantly more sophisticated and finding the key is correspondingly more difficult. The goal of this project is to find ways to detect ransomware more efficiently and neutralize ransomware more effectively (in particular, at the e-mail and web gateways before it reaches end-user devices) than is possible using current technology.

近年来越来越重要的恶意软件类别是勒索软件，这是一种恶意软件，它阻止数据和系统被其所有者访问（通常使用锁定或加密机制），并要求受害者向攻击者支付赎金以重新获得访问权限。对于一些简单形式的勒索软件，可以找到密钥并解密加密的用户文件（以便受害者不必向攻击者支付赎金），但其他形式的勒索软件明显更复杂，找到密钥也相应更困难。该项目的目标是找到比现有技术更有效地检测勒索软件和更有效地消除勒索软件的方法（特别是在电子邮件和Web网关到达最终用户设备之前）。