勒索软件检测技术的中和方法使用格式保存加密技术
Jaehyuk Lee1, Sun-Young Lee2, Kangbin Yim2
1Interdisciplinary Program of Information & Protection, Mokpo National University, Muan 58554, Republic of Korea.
Sensors (Basel, Switzerland)
|July 11, 2023
概括
本研究介绍了一种新的勒索软件中和方法,通过使用格式保护加密来绕过基于的检测. 新技术将PPTX文件的勒索软件检测准确度提高96%,为恶意软件提供更复杂的防御.
科学领域:
- 网络安全 网络安全
- 恶意软件分析 恶意软件分析
- 信息安全 信息安全
背景情况:
- 勒索软件使用文件加密来勒索受害者,构成重大威胁.
- 现有的检测方法,包括测量,有局限性,可以绕过.
- 使用编码的勒索软件中和技术,如base64,在解码后易受检测.
研究的目的:
- 开发一种先进的勒索软件检测和中和方法,能够抵御当前的绕过技术.
- 从攻击者的角度提出中和要求,以提高有效性.
- 引入格式保护加密作为加密中和勒索软件的优越替代方案.
主要方法:
- 为了实现复杂的中和,他得出了三个以攻击者为中心的要求:没有解码,支持秘密信息,以及与普通文本相似的加密文本.
- 使用格式保护加密 (FPE) 来操纵密码文本和绕过检测.
- 评估了FPE应用的字节分割,二进制ToASCII和半径转换方法,确定半径转换为最佳.
主要成果:
- 使用FPE进行放射转换的拟议方法满足了衍生要求,使得无需解码的加密能够实现.
- 在0.5的值下,为PPTX文件实现了96%的中和精度,显著优于现有方法.
- 证明了FPE在控制加密文本的有效性,用于高级勒索软件中和.
结论:
- 格式保护加密为勒索软件中和提供了强大的解决方案,克服了基于编码的方法的局限性.
- 根基转换方法与FPE相结合,为逃避基于的勒索软件检测提供了一个非常有效的策略.
- 这项研究为开发对复杂的勒索软件中和策略的未来对策提供了关键的见解.
相关概念视频
01:15Western Blotting
16.5K
Western blotting is an analytical technique for protein identification. It has various applications in immunology and medicine, including detecting diseases like bovine spongiform encephalopathy, mad cow disease, and human and feline immunodeficiency virus from biological samples.
The technique begins with separating proteins from the sample using sodium dodecyl sulfate-polyacrylamide gel electrophoresis (SDS-PAGE), followed by protein transfer, immunoblotting, and finally, protein detection.
The technique begins with separating proteins from the sample using sodium dodecyl sulfate-polyacrylamide gel electrophoresis (SDS-PAGE), followed by protein transfer, immunoblotting, and finally, protein detection.
16.5K
01:18Effects of EDTA on End-Point Detection Methods
307
Different methods, such as visual observance of metal-ion indicators, spectroscopic techniques, and potentiometric methods, can determine the endpoint of an EDTA titration.
In the visual method, metal-ion indicators (metallochromic dyes), which have distinct colors in their free and complex forms, are added to the mixture to signal the titration's end point. They form stable complexes with metal ions, but these complexes are weaker than the corresponding metal–EDTA complexes. As a...
In the visual method, metal-ion indicators (metallochromic dyes), which have distinct colors in their free and complex forms, are added to the mixture to signal the titration's end point. They form stable complexes with metal ions, but these complexes are weaker than the corresponding metal–EDTA complexes. As a...
307
01:19Masking and Demasking Agents
2.5K
EDTA titrations may necessitate masking and demasking agents to temporarily protect a particular metal ion in a mixture from the EDTA reaction. These agents facilitate the sequential analysis of the metal ions by forming stable complexes with some—but not all—metal ions during certain steps.
There are many masking agents, such as cyanide, fluoride, triethanolamine, thiourea, and 2,3-bis(sulfanyl)propan-1-ol (formerly 2,3-dimercapto-1-propanol), with the masking agent chosen based on...
There are many masking agents, such as cyanide, fluoride, triethanolamine, thiourea, and 2,3-bis(sulfanyl)propan-1-ol (formerly 2,3-dimercapto-1-propanol), with the masking agent chosen based on...
2.5K