Monitoring, Detecting, and Preventing Ransomware Attacks in Controlled Virtual Network Environments Using a File Scanner
摘要
Today, computers are the primary source of information about a given user or corporation. Unfortunately, some criminal minds can access relevant data, manipulate it for ransom, and profit from it. Among the different types of attacks, a prevalent one is ransomware. Ransomware consists of the encryption or “hijacking” of files and data on a computer. This study simulates a Ransomware attack from a virtual machine to a victim’s virtual server. The simulation includes infiltration, file scanning, data encryption, and demand for extortion by imitating the behavior of an attacker. At the same time, we implemented an anti-malware algorithm that, during its execution, monitors, detects, notifies, and blocks the execution of suspicious code. We developed both the attack and defense algorithms using Python. The results show the effectiveness of the proposed solution and its limitations in a controlled virtual network environment.