Analysing Indicator of Compromises for Ransomware: Leveraging IOCs with Machine Learning Techniques
Mayank Verma, Ponnurangam Kumarguru, Shuva Brata Deb, Anuradha Gupta · 2018
Ransomware is a malware which is spreading largely around the world and imposing serious threats to information assets and victimizes internet users by hijacking and encrypting their files, and then demanding payment to get back access to the files. Seeking system vulnerabilities, ransomware tries to seize control over the victim's files and system, until the victim agrees to the attacker's demands. In this paper, we have extended the work by focusing on Indicator of Compromises (IOCs) for ransomware using Cuckoo Sandbox. These IOCs are used to set the base for the analysis and classification of new ransomware into their respective class. Further, working for the implementation of the proposed idea, we have automated the system using machine learning algorithms for the classification of ransomware variants in the real time environment. To the best of our knowledge, this is the first real time, comprehensive and usable methodology to classify the ransomware in their respective classes.