一句话：通过7796个勒索软件样本的大规模实证分析，揭示数据侦察、篡改与外泄行为并提出分阶段缓解策略。
本文针对勒索软件对软件生态的严重威胁，开展大规模实证分析以支撑更有效的未知攻击防御。作者构建了包含7796个活跃勒索软件样本的真实数据集MarauderMap，并在隔离测试床中执行所有样本，采集API调用、I/O访问、网络流量等六类运行时行为，日志总量达1.98 TiB。通过评估这些行为，论文在数据侦察、数据篡改和数据外泄阶段给出了六项关键发现，并据此提出三种对应阶段的检测缓解策略。实验表明，这些策略能够增强现有反勒索软件工具的能力，在未增加误报的情况下将检测率提升41%至69%，说明所获洞见具有实用价值。
The threat of ransomware to the software ecosystem has become increasingly alarming in recent years, raising a demand for large-scale and comprehensive ransomware analysis to help develop more effective countermeasures against unknown attacks. In this paper, we first collect a real-world dataset MarauderMap, consisting of 7,796 active ransomware samples, and analyze their behaviors of disrupting data in victim systems. All samples are executed in isolated testbeds to collect all perspectives of six categories of runtime behaviors, such as API calls, I/O accesses, and network traffic. The total logs volume is up to 1.98 TiB. By assessing collected behaviors, we present six critical findings throughout ransomware attacks' data reconnaissance, data tampering, and data exfiltration phases. Based on our findings, we propose three corresponding mitigation strategies to detect ransomware during each phase. Experimental results show that they can enhance the capability of state-of-the-art anti-ransomware tools. We report a preliminary result of a 41%-69% increase in detection rate with no additional false positives, showing that our insights are helpful.
@inproceedings{paperbot11373,
title = {An Empirical Study of Data Disruption by Ransomware Attacks},
author = {Yiwei Hou and Lihua Guo and Chijin Zhou and Yiwen Xu and Zijing Yin and Shanshan Li and Chengnian Sun and Yu Jiang},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639090}
}