对勒索软件加密文件识别的热量计算方法的比较
Simon R Davies1, Richard Macfarlane1, William J Buchanan1
1Blockpass ID Lab, School of Computing, Edinburgh Napier University, Edinburgh EH10 5DT, UK.
Entropy (Basel, Switzerland)
|July 8, 2023
概括
这项研究评估了53种计算方法来检测加密勒索软件. 它确定了优越的技术来区分加密文件和正常数据,提高勒索软件检测准确度.
科学领域:
- 计算机科学 计算机科学
- 网络安全 网络安全
- 数据分析 数据分析
背景情况:
- 加密勒索软件通过加密数据来攻击系统可用性.
- 目前的检测方法经常使用文件,但缺乏技术选择的理由.
- 香农是常用的,但可能不是最佳的识别加密文件.
研究的目的:
- 为了比较各种计算方法的准确性,用于检测加密勒索软件加密文件.
- 确定最有效的技术,以区分加密数据与其他文件类型.
- 调查混合方法的潜力,以提高检测准确度.
主要方法:
- 在两个阶段评估了53个不同的测试:候选人识别和彻底评估.
- 使用了NapierOne数据集,其中包含数千种文件类型和加密勒索软件示例.
- 在超过27万个文件上测试了11个候选技术,执行了近300万次计算.
主要成果:
- 确定了各种方法在区分加密文件的准确性上的显著差异.
- 确定了每个测试在识别加密勒索软件加密文件中的整体准确性.
- 研究了将多个测试结合在混合方法中的有效性.
结论:
- 某些计算方法在检测加密勒索软件方面比其他方法更有效.
- 选择计算技术显著影响加密文件识别的准确性.
- 混合方法可以提高勒索软件检测的准确性.
相关概念视频
Entropy and the Second Law of Thermodynamics
2.9K
The second law of thermodynamics can be stated quantitatively using the concept of entropy. Entropy is the measure of disorder of the system.
The relation between entropy and disorder can be illustrated with the example of the phase change of ice to water. In ice, the molecules are located at specific sites giving a solid state, whereas, in a liquid form, these molecules are much freer to move. The molecular arrangement has therefore become more randomized. Although the change in average...
The relation between entropy and disorder can be illustrated with the example of the phase change of ice to water. In ice, the molecules are located at specific sites giving a solid state, whereas, in a liquid form, these molecules are much freer to move. The molecular arrangement has therefore become more randomized. Although the change in average...
2.9K
Standard Entropy Change for a Reaction
20.6K
Entropy is a state function, so the standard entropy change for a chemical reaction (ΔS°rxn) can be calculated from the difference in standard entropy between the products and the reactants.
20.6K
Wald-Wolfowitz Runs Test II
272
The Wald-Wolfowitz runs test, commonly referred to as the runs test, is a nonparametric test used to assess the randomness of ordered data. The test evaluates the number of runs, which are consecutive sequences of similar elements within the data. If the number of runs is significantly higher or lower than expected, the data is considered non-random, indicating a detectable pattern or structure.
For binary data, runs are identified using symbols such as + and −, or equivalently, 1s and...
For binary data, runs are identified using symbols such as + and −, or equivalently, 1s and...
272
Entropy Change in Reversible Processes
2.6K
In the Carnot engine, which achieves the maximum efficiency between two reservoirs of fixed temperatures, the total change in entropy is zero. The observation can be generalized by considering any reversible cyclic process consisting of many Carnot cycles. Thus, it can be stated that the total entropy change of any ideal reversible cycle is zero.
The statement can be further generalized to prove that entropy is a state function. Take a cyclic process between any two points on a p-V diagram.
The statement can be further generalized to prove that entropy is a state function. Take a cyclic process between any two points on a p-V diagram.
2.6K
Third Law of Thermodynamics
19.1K
A pure, perfectly crystalline solid possessing no kinetic energy (that is, at a temperature of absolute zero, 0 K) may be described by a single microstate, as its purity, perfect crystallinity,and complete lack of motion means there is but one possible location for each identical atom or molecule comprising the crystal (W = 1). According to the Boltzmann equation, the entropy of this system is zero.
19.1K
Entropy and Solvation
7.1K
The process of surrounding a solute with solvent is called solvation. It involves evenly distributing the solute within the solvent. The rule of thumb for determining a solvent for a given compound is that like dissolves like. A good solvent has molecular characteristics similar to those of the compound to be dissolved. For example, polar solutions dissolve polar solutes, and apolar solvents dissolve apolar solutes. A polar solvent is a solvent that has a high dielectric constant (ϵ...
7.1K


