Ransomware has posed a significant threat to cybersecurity. Although techniques such as anomalous behavior detection have proven effective in mitigating its threats, several potential challenges have emerged that may undermine the reliability of these defenses. Specifically, the large volume of events generated during attacks causes significant challenges for efficient ransomware analysis, thereby hindering timely detection and response. Besides, malicious processes are interwoven with benign activities, which introduces irregular noise and compromises the effectiveness of detection. To address these challenges, we propose FuzzyHawk, which excels at extracting behavior patterns and detecting ransomware behaviors under noisy environments. First, it employs a graph-based representation of process behaviors and incorporates a high-frequency subgraph extraction mechanism to distill representative behavioral patterns efficiently. Besides, it employs a fuzzy matching mechanism that tolerates disturbances of system noise and enhances the robustness of ransomware detection. Experimental results on a large-scale public dataset (about 50 million events, covering 378 ransomware samples) demonstrate that FuzzyHawk achieves a remarkable true positive rate of 97.3% on 10,397 unseen ransomware behavioral traces, proving its strong capability for ransomware detection.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

FuzzyHawk: Unveiling Ransomware Behavior Patterns via Graph-Based Fuzzy Matching

  • Lingbo Zhao,
  • Yuhui Zhang,
  • Rui Hou

摘要

Ransomware has posed a significant threat to cybersecurity. Although techniques such as anomalous behavior detection have proven effective in mitigating its threats, several potential challenges have emerged that may undermine the reliability of these defenses. Specifically, the large volume of events generated during attacks causes significant challenges for efficient ransomware analysis, thereby hindering timely detection and response. Besides, malicious processes are interwoven with benign activities, which introduces irregular noise and compromises the effectiveness of detection. To address these challenges, we propose FuzzyHawk, which excels at extracting behavior patterns and detecting ransomware behaviors under noisy environments. First, it employs a graph-based representation of process behaviors and incorporates a high-frequency subgraph extraction mechanism to distill representative behavioral patterns efficiently. Besides, it employs a fuzzy matching mechanism that tolerates disturbances of system noise and enhances the robustness of ransomware detection. Experimental results on a large-scale public dataset (about 50 million events, covering 378 ransomware samples) demonstrate that FuzzyHawk achieves a remarkable true positive rate of 97.3% on 10,397 unseen ransomware behavioral traces, proving its strong capability for ransomware detection.