An Ontology-Based Representation of Knowledge for Specifying Ransomware Behavior
Manh-Duc Hoang, Duc–Anh Nguyen, Nhat-Huy Nguyen, Viet-Chien Nguyen, Duy-Huy Doan, Viet-Nam Ta, Linh Manh Pham · 2025
This paper introduces CyberRanto, an ontology-based framework for analyzing ransomware behavior. As ransomware attacks grow more sophisticated, structured knowledge representation becomes crucial. CyberRanto, developed from a thorough review of ransomware lifecycle stages, categorizes actions into phases like infiltration, Behavior detail properties, and ransom demand. This aids in early detection, prevention, and investigation of cyber threats. Leveraging real-world instances and diverse behavioral patterns, the framework enhances threat intelligence, supports digital forensics, and is useful for cybersecurity training. Future research may adapt this framework to emerging ransomware variants, maintaining its relevance in dynamic threat landscapes.