Cyberthreat hunting - Part 2: tracking ransomware threat actors using fuzzy hashing and fuzzy c-means clustering

Nitin Naik, Paul Jenkins, Nick Savage, Longzhi Yang

Research output: Chapter in Book/Report/Conference proceedingConference contribution

98 Downloads (Pure)

Abstract

Threat actors are constantly seeking new attack surfaces, with ransomeware being one the most successful attack vectors that have been used for financial gain. T his has been achieved through the dispersion of unlimited polymorphic samples of ransomware whilst those responsible evade detection and hide their identity. Nonetheless, every ransomware threat actor adopts some similar style or uses some common patterns in their malicious code writing, which can be significant evidence contributing to their identification. he first step in attempting to identify the source of the attack is to cluster a large number of ransomware samples based on very little or no information about the samples, accordingly, their traits and signatures can be analysed and identified. Therefore, this paper proposes an efficient fuzzy analysis approach to cluster ransomware samples based on the combination of two fuzzy techniques fuzzy hashing and fuzzy c-means (FCM) clustering. Unlike other clustering techniques, FCM can directly utilise similarity scores generated by a fuzzy hashing method and cluster them into similar groups without requiring additional transformational steps to obtain distance among objects for clustering. Thus, it reduces the computational overheads by utilising fuzzy similarity scores obtained at the time of initial triaging of whether the sample is known or unknown ransomware. The performance of the proposed fuzzy method is compared against k-means clustering and the two fuzzy hashing methods SSDEEP and SDHASH which are evaluated based on their FCM clustering results to understand how the similarity score affects the clustering results.
Original languageEnglish
Title of host publication2019 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE)
PublisherIEEE
Number of pages6
ISBN (Electronic)978-1-5386-1728-1
ISBN (Print)978-1-5386-1729-8
DOIs
Publication statusEarly online - 10 Oct 2019
Event2019 IEEE International Conference: Fuzzy Systems - New Orleans, United States
Duration: 23 Jun 201926 Nov 2019
https://ieeexplore.ieee.org/xpl/conhome/8845563/proceeding

Publication series

NameFuzzy Systems (FUZZ-IEEE) 2019 IEEE International Conference
PublisherIEEE
ISSN (Print)1558-4739

Conference

Conference2019 IEEE International Conference
Abbreviated titleFUZZ-IEEE
Country/TerritoryUnited States
CityNew Orleans
Period23/06/1926/11/19
Internet address

Fingerprint

Dive into the research topics of 'Cyberthreat hunting - Part 2: tracking ransomware threat actors using fuzzy hashing and fuzzy c-means clustering'. Together they form a unique fingerprint.

Cite this