Cyberthreat hunting - Part 1: triaging ransomware using fuzzy hashing, import hashing and YARA rules

Nitin Naik; Paul Jenkins; Nick Savage; Longzhi Yang

doi:10.1109/FUZZ-IEEE.2019.8858803

Cyberthreat hunting - Part 1: triaging ransomware using fuzzy hashing, import hashing and YARA rules

Nitin Naik
, Paul Jenkins
, Nick Savage
, Longzhi Yang

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

446 Downloads (Pure)

Abstract

Ransomware is currently one of the most significant cyberthreats to both national infrastructure and the individual, often requiring severe treatment as an antidote. Triaging ran-somware based on its similarity with well-known ransomware samples is an imperative preliminary step in preventing a ransomware pandemic. Selecting the most appropriate triaging method can improve the precision of further static and dynamic analysis in addition to saving significant t ime a nd e ffort. Currently, the most popular and proven triaging methods are fuzzy hashing, import hashing and YARA rules, which can ascertain whether, or to what degree, two ransomware samples are similar to each other. However, the mechanisms of these three methods are quite different and their comparative assessment is difficult. Therefore, this paper presents an evaluation of these three methods for triaging the four most pertinent ransomware categories WannaCry, Locky, Cerber and CryptoWall. It evaluates their triaging performance and run-time system performance, highlighting the limitations of each method.

Original language	English
Title of host publication	2019 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE)
Publisher	Institute of Electrical and Electronics Engineers Inc.
Number of pages	6
ISBN (Electronic)	978-1-5386-1728-1
ISBN (Print)	978-1-5386-1729-8
DOIs	https://doi.org/10.1109/FUZZ-IEEE.2019.8858803
Publication status	Published - 10 Oct 2019
Event	2019 IEEE International Conference: Fuzzy Systems - New Orleans, United States Duration: 23 Jun 2019 → 26 Nov 2019 https://ieeexplore.ieee.org/xpl/conhome/8845563/proceeding

Publication series

Name	Fuzzy Systems (FUZZ-IEEE) 2019 IEEE International Conference
Publisher	IEEE
ISSN (Print)	1558-4739

Conference

Conference	2019 IEEE International Conference
Abbreviated title	FUZZ-IEEE
Country/Territory	United States
City	New Orleans
Period	23/06/19 → 26/11/19
Internet address	https://ieeexplore.ieee.org/xpl/conhome/8845563/proceeding

Access to Document

10.1109/FUZZ-IEEE.2019.8858803

FUZZ-IEEE-19-Paper-I
© © 2019 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.
Accepted author manuscript (Post-print), 209 KB

Cite this

Naik, N., Jenkins, P., Savage, N., & Yang, L. (2019). Cyberthreat hunting - Part 1: triaging ransomware using fuzzy hashing, import hashing and YARA rules. In 2019 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE) (Fuzzy Systems (FUZZ-IEEE) 2019 IEEE International Conference). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/FUZZ-IEEE.2019.8858803

@inproceedings{26eecf3657444120a77d312180ff525e,

title = "Cyberthreat hunting - Part 1: triaging ransomware using fuzzy hashing, import hashing and YARA rules",

abstract = "Ransomware is currently one of the most significant cyberthreats to both national infrastructure and the individual, often requiring severe treatment as an antidote. Triaging ran-somware based on its similarity with well-known ransomware samples is an imperative preliminary step in preventing a ransomware pandemic. Selecting the most appropriate triaging method can improve the precision of further static and dynamic analysis in addition to saving significant t ime a nd e ffort. Currently, the most popular and proven triaging methods are fuzzy hashing, import hashing and YARA rules, which can ascertain whether, or to what degree, two ransomware samples are similar to each other. However, the mechanisms of these three methods are quite different and their comparative assessment is difficult. Therefore, this paper presents an evaluation of these three methods for triaging the four most pertinent ransomware categories WannaCry, Locky, Cerber and CryptoWall. It evaluates their triaging performance and run-time system performance, highlighting the limitations of each method.",

author = "Nitin Naik and Paul Jenkins and Nick Savage and Longzhi Yang",

year = "2019",

month = oct,

day = "10",

doi = "10.1109/FUZZ-IEEE.2019.8858803",

language = "English",

isbn = "978-1-5386-1729-8",

series = "Fuzzy Systems (FUZZ-IEEE) 2019 IEEE International Conference",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

booktitle = "2019 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE)",

address = "United States",

note = "2019 IEEE International Conference : Fuzzy Systems, FUZZ-IEEE ; Conference date: 23-06-2019 Through 26-11-2019",

url = "https://ieeexplore.ieee.org/xpl/conhome/8845563/proceeding",

}

Naik, N, Jenkins, P, Savage, N & Yang, L 2019, Cyberthreat hunting - Part 1: triaging ransomware using fuzzy hashing, import hashing and YARA rules. in 2019 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE). Fuzzy Systems (FUZZ-IEEE) 2019 IEEE International Conference, Institute of Electrical and Electronics Engineers Inc., 2019 IEEE International Conference, New Orleans, Louisiana, United States, 23/06/19. https://doi.org/10.1109/FUZZ-IEEE.2019.8858803

Cyberthreat hunting - Part 1: triaging ransomware using fuzzy hashing, import hashing and YARA rules. / Naik, Nitin; Jenkins, Paul; Savage, Nick et al.
2019 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE). Institute of Electrical and Electronics Engineers Inc., 2019. (Fuzzy Systems (FUZZ-IEEE) 2019 IEEE International Conference).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Cyberthreat hunting - Part 1: triaging ransomware using fuzzy hashing, import hashing and YARA rules

AU - Naik, Nitin

AU - Jenkins, Paul

AU - Savage, Nick

AU - Yang, Longzhi

PY - 2019/10/10

Y1 - 2019/10/10

N2 - Ransomware is currently one of the most significant cyberthreats to both national infrastructure and the individual, often requiring severe treatment as an antidote. Triaging ran-somware based on its similarity with well-known ransomware samples is an imperative preliminary step in preventing a ransomware pandemic. Selecting the most appropriate triaging method can improve the precision of further static and dynamic analysis in addition to saving significant t ime a nd e ffort. Currently, the most popular and proven triaging methods are fuzzy hashing, import hashing and YARA rules, which can ascertain whether, or to what degree, two ransomware samples are similar to each other. However, the mechanisms of these three methods are quite different and their comparative assessment is difficult. Therefore, this paper presents an evaluation of these three methods for triaging the four most pertinent ransomware categories WannaCry, Locky, Cerber and CryptoWall. It evaluates their triaging performance and run-time system performance, highlighting the limitations of each method.

AB - Ransomware is currently one of the most significant cyberthreats to both national infrastructure and the individual, often requiring severe treatment as an antidote. Triaging ran-somware based on its similarity with well-known ransomware samples is an imperative preliminary step in preventing a ransomware pandemic. Selecting the most appropriate triaging method can improve the precision of further static and dynamic analysis in addition to saving significant t ime a nd e ffort. Currently, the most popular and proven triaging methods are fuzzy hashing, import hashing and YARA rules, which can ascertain whether, or to what degree, two ransomware samples are similar to each other. However, the mechanisms of these three methods are quite different and their comparative assessment is difficult. Therefore, this paper presents an evaluation of these three methods for triaging the four most pertinent ransomware categories WannaCry, Locky, Cerber and CryptoWall. It evaluates their triaging performance and run-time system performance, highlighting the limitations of each method.

U2 - 10.1109/FUZZ-IEEE.2019.8858803

DO - 10.1109/FUZZ-IEEE.2019.8858803

M3 - Conference contribution

SN - 978-1-5386-1729-8

T3 - Fuzzy Systems (FUZZ-IEEE) 2019 IEEE International Conference

BT - 2019 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE)

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 2019 IEEE International Conference

Y2 - 23 June 2019 through 26 November 2019

ER -

Cyberthreat hunting - Part 1: triaging ransomware using fuzzy hashing, import hashing and YARA rules

Abstract

Publication series

Conference

Access to Document

Fingerprint

Cite this