Ransomware protection using the moving target defense perspective

Suhyeon Lee, Huy Kang Kim, Kyounggon Kim

Research output: Contribution to journalArticle

Abstract

Ransomware has become the most dangerous threat today because of its unique and destructive characteristics. Ransomware encrypts the victim's important files and then requires money to decrypt them. Ransomware has become among the most preferred measures for cybercriminals to earn money. Moreover, the technology for producing ransomware continues to evolve; as a result, it has becomes more difficult to defend. In this study, we analyze major ransomware including WannaCry and propose a method to protect valuable files from existing ransomware. To this end, the moving target defense method is applied by randomly changing the file extensions that ransomware attempts to encrypt. We show that our proposed method can successfully protect files from ransomware. Finally, we present the proposed method which can be reasonably used without performance degradation.

Original languageEnglish
Pages (from-to)288-299
Number of pages12
JournalComputers and Electrical Engineering
Volume78
DOIs
Publication statusPublished - 2019 Sep 1

Fingerprint

Malware
Degradation

Keywords

  • File extension
  • Malware
  • Moving target defense
  • Randomization
  • Ransomware

ASJC Scopus subject areas

  • Control and Systems Engineering
  • Computer Science(all)
  • Electrical and Electronic Engineering

Cite this

Ransomware protection using the moving target defense perspective. / Lee, Suhyeon; Kim, Huy Kang; Kim, Kyounggon.

In: Computers and Electrical Engineering, Vol. 78, 01.09.2019, p. 288-299.

Research output: Contribution to journalArticle

@article{3a0551761c2e462e975e167f24a14e0f,
title = "Ransomware protection using the moving target defense perspective",
abstract = "Ransomware has become the most dangerous threat today because of its unique and destructive characteristics. Ransomware encrypts the victim's important files and then requires money to decrypt them. Ransomware has become among the most preferred measures for cybercriminals to earn money. Moreover, the technology for producing ransomware continues to evolve; as a result, it has becomes more difficult to defend. In this study, we analyze major ransomware including WannaCry and propose a method to protect valuable files from existing ransomware. To this end, the moving target defense method is applied by randomly changing the file extensions that ransomware attempts to encrypt. We show that our proposed method can successfully protect files from ransomware. Finally, we present the proposed method which can be reasonably used without performance degradation.",
keywords = "File extension, Malware, Moving target defense, Randomization, Ransomware",
author = "Suhyeon Lee and Kim, {Huy Kang} and Kyounggon Kim",
year = "2019",
month = "9",
day = "1",
doi = "10.1016/j.compeleceng.2019.07.014",
language = "English",
volume = "78",
pages = "288--299",
journal = "Computers and Electrical Engineering",
issn = "0045-7906",
publisher = "Elsevier Limited",

}

TY - JOUR

T1 - Ransomware protection using the moving target defense perspective

AU - Lee, Suhyeon

AU - Kim, Huy Kang

AU - Kim, Kyounggon

PY - 2019/9/1

Y1 - 2019/9/1

N2 - Ransomware has become the most dangerous threat today because of its unique and destructive characteristics. Ransomware encrypts the victim's important files and then requires money to decrypt them. Ransomware has become among the most preferred measures for cybercriminals to earn money. Moreover, the technology for producing ransomware continues to evolve; as a result, it has becomes more difficult to defend. In this study, we analyze major ransomware including WannaCry and propose a method to protect valuable files from existing ransomware. To this end, the moving target defense method is applied by randomly changing the file extensions that ransomware attempts to encrypt. We show that our proposed method can successfully protect files from ransomware. Finally, we present the proposed method which can be reasonably used without performance degradation.

AB - Ransomware has become the most dangerous threat today because of its unique and destructive characteristics. Ransomware encrypts the victim's important files and then requires money to decrypt them. Ransomware has become among the most preferred measures for cybercriminals to earn money. Moreover, the technology for producing ransomware continues to evolve; as a result, it has becomes more difficult to defend. In this study, we analyze major ransomware including WannaCry and propose a method to protect valuable files from existing ransomware. To this end, the moving target defense method is applied by randomly changing the file extensions that ransomware attempts to encrypt. We show that our proposed method can successfully protect files from ransomware. Finally, we present the proposed method which can be reasonably used without performance degradation.

KW - File extension

KW - Malware

KW - Moving target defense

KW - Randomization

KW - Ransomware

UR - http://www.scopus.com/inward/record.url?scp=85069972770&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85069972770&partnerID=8YFLogxK

U2 - 10.1016/j.compeleceng.2019.07.014

DO - 10.1016/j.compeleceng.2019.07.014

M3 - Article

AN - SCOPUS:85069972770

VL - 78

SP - 288

EP - 299

JO - Computers and Electrical Engineering

JF - Computers and Electrical Engineering

SN - 0045-7906

ER -