A behavioural in‐depth analysis of ransomware infection. (30th December 2020)

• Record Type: Journal Article
• Authors: Lemmou, Yassine; Lanet, Jean‐Louis; Souidi, El Mamoun
• Is Part Of: IET information security. Volume 15:Number 1(2021)
• Page Start: 38
• Page End: 58
• Publication Date: 2020-12-30
• Subjects: Computer security -- Periodicals; Cryptography -- Periodicals; Computer networks -- Security measures -- Periodicals; Database security -- Periodicals; 005.8
• DOI: 10.1049/ise2.12004
• Languages: English
• ISSNs: 1751-8709

Abstract

Abstract: Ransomware is a type of malware that has spread rapidly over the last 4 years, causing significant damage, especially in Windows environments. It is designed to encrypt or block victim's data, including documents, backups, and databases, unless a ransom is paid. In this study, the authors present the results of their research on Windows crypto‐ransomware during the last 3 years by exploring and discussing the relevant ransomware behaviours. The results of this study can be used to identify or to detect the ransomware. Indeed, these behaviours were extracted from in‐depth manual analysis of more than 20 ransomware families, including the known and the recent families. In addition, some extracted behaviours were automatically searched for more than 200 different ransomware collected during 2019.