Técnicas de machine Learning para la detección de Ransomware: Revisión sistemática de Literatura

Autores/as

  • Oscar Miguel Cumbicus Pineda Universidad Nacional de Loja
  • Pablo Vinicio Ludeña Preciado Universidad Nacional de Loja
  • Lisset Alexandra Neyra Romero Universidad Nacional de Loja

Palabras clave:

Ransomware, Aprendizaje Automático, Aprendizaje Profundo, Algoritmos, Detección de Malware.

Resumen

El ransomware es uno de los problemas de seguridad informática más críticos, es un tipo de malware que cifra o bloquea la información de la víctima para solicitar el pago de un rescate y devolverles el acceso a sus datos. La presente investigación tuvo el propósito de identificar las técnicas y/o algoritmos de Machine Learning (ML) utilizadas para la detección y clasificación de las diferentes familias ransomware, así como las herramientas de software que se utilizan para la aplicación de estos algoritmos. Está revisión sistemática de literatura (RSL) se apoyó en la metodología propuesta por Bárbara Kitchenham y en el uso de la herramienta Parsifal. Los resultados obtenidos muestran que los algoritmos y/o técnicas de machine learning más utilizados son: Random Forest (RF) con el 23 %, Decisión Tree (DT) con un 14 %, Long Short-Term Memory (LSTM) utilizado en un 9 %, Support Vector Machine Learning (SVM) y Deep Neural Network (DNN) con el 6 %. Las herramientas más utilizadas para la aplicación de los algoritmos de machine learning, fueron Cuckoo Sandbox y Weka Framework con el 17 %. Llegando a la conclusión que el machine learning permite detectar en las etapas iniciales patrones de diferentes familias ransomware.

Descargas

Los datos de descargas todavía no están disponibles.

Citas

AbdulsalamYa’u, G., Job, G. K., Waziri, S. M., Jaafar, B., SabonGari, N. A., y Yakubu, I. Z. (2019, diciembre). Deep Learning for Detecting Ransomware in Edge Computing Devices Based On Autoencoder Classifier. En 2019 4th International Conference on Electrical, Electronics, Communication, Computer Technologies and Optimization Techniques (ICEECCOT) (pp. 240–243). Mysuru, India: IEEE. Descargado 2022-01-23, de https:// ieeexplore.ieee.org/document/9114576/ doi: 10 .1109/ICEECCOT46775.2019.9114576

Agrawal, R., Stokes, J. W., Selvaraj, K., y Marinescu, M. (2019, mayo). Attention in Recurrent Neural Networks for Ransomware Detection. En ICASSP 2019 - 2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) (pp. 3222–3226). Brighton, United Kingdom: IEEE. Descargado 2022-01-23, de https://ieeexplore.ieee.org/document/8682899/ doi: 10.1109/ICASSP.2019.8682899

Al-Hawawreh, M., y Sitnikova, E. (2019, noviembre). Leveraging Deep Learning Models for Ransomware Detection in the Industrial Internet of Things Environment. En 2019 Military Communications and Information Systems Conference (MilCIS) (pp. 1–6). Canberra, Australia: IEEE. Descargado 2022-01-23, de https://ieeexplore.ieee .org/document/8930732/ doi: 10.1109/MilCIS.2019 .8930732

Almomani, I., AlKhayer, A., y Ahmed, M. (2021, abril). An Efficient Machine Learning-based Approach for Android v.11 Ransomware Detection. En 2021 1st International Conference on Artificial Intelligence and Data Analytics (CAIDA) (pp. 240–244). Riyadh, Saudi Arabia: IEEE.

Descargado 2022-01-23, de https://ieeexplore.ieee .org/document/9425059/ doi: 10.1109/CAIDA51941 .2021.9425059

Almousa, M., Osawere, J., y Anwar, M. (2021, septiembre). Identification of Ransomware families by Analyzing Network Traffic Using Machine Learning Techniques. En 2021 Third International Conference on Transdisciplinary AI (TransAI) (pp. 19–24). doi: 10.1109/TransAI51903 .2021.00012

Alrawashdeh, K., y Purdy, C. (2018, julio). Ransomware Detection Using Limited Precision Deep Learning Structure in FPGA. En NAECON 2018 - IEEE National Aerospace and Electronics Conference (pp. 152–157). Dayton, OH, USA: IEEE. Descargado 2022-01-23, de https://ieeexplore.ieee.org/document/8556824/ doi: 10.1109/NAECON.2018.8556824

Alzahrani, N., y Alghazzawi, D. (2019, noviembre). A

Review on Android Ransomware Detection Using Deep Learning Techniques. En Proceedings of the 11th International Conference on Management of Digital EcoSystems (pp. 330–335). Limassol Cyprus: ACM. Descargado: 2022-01-23, de https://dl.acm.org/doi/10.1145/3297662.3365785 doi: 10.1145/3297662.3365785

Arabo, A., Dijoux, R., Poulain, T., y Chevalier, G. (2020). Detecting Ransomware Using Process Behavior Analysis. 2022-01-23, de https://linkinghub.elsevier.com/ retrieve/pii/S1877050920303884 doi: 10 .1016/j.procs.2020.02.249

Aurangzeb, S., Bin Rais, R., Aleem, M., Islam, M., y Iqbal, M. (2021). On the classification of MicrosoftWindows ransomware using hardware profile. PeerJ Computer Science, 7, 1–24. doi: 10.7717/peerj-cs.361

Basnet, M., Poudyal, S., Ali, M. H., y Dasgupta, D. (2021, septiembre). Ransomware Detection Using Deep Learning in the SCADA System of Electric Vehicle Charging Station. En 2021 IEEE PES Innovative Smart Grid Technologies Conference - Latin America (ISGT Latin America) (pp. 1–5). (ISSN: 2643-8798) doi: 10.1109/ ISGTLatinAmerica52371.2021.9543031

Bello, I., Chiroma, H., Abdullahi, U. A., Gital, A. Y., Jauro, F., Khan, A., ... Abdulhamid, S. M. (2021, septiembre). Detecting ransomware attacks using intelligent algorithms: recent development and next direction from deep learning and big data perspectives. Journal of Ambient Intelligence and Humanized Computing, 12(9), 8699–8717. Descargado 2022-01-23, de https://link.springer.com/10.1007/s12652-020-02630-7 doi: 10.1007/s12652-020-02630-7

Brereton, P., Kitchenham, B. A., Budgen, D., Turner, M., y Khalil, M. (2007). Lessons from applying the systematic literature review process within the software engineering domain. Journal of systems and software, 80(4), 571–583.

Chadha, S., y Kumar, U. (2017, mayo). Ransomware: Let’s fight back! En 2017 International Conference on Computing, Communication and Automation (ICCCA) (pp. 925– 930). Greater Noida: IEEE. Descargado 2022-01-23, de http://ieeexplore.ieee.org/document/8229926/ doi: 10.1109/CCAA.2017.8229926

Corporation for Digital Scholarship. (2022, 01 03). Zotero. Retrieved from https://www.zotero.org/

Cusack, G., Michel, O., y Keller, E. (2018, marzo). Machine Learning-Based Detection of Ransomware Using SDN. En Proceedings of the 2018 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization (pp. 1–6). Tempe AZ USA: ACM. Descargado 2021-12-10, de https://dl.acm.org/doi/10.1145/3180465.3180467 doi: 10.1145/3180465.3180467

Daku, H., Zavarsky, P., y Malik, Y. (2018, agosto).

Behavioral-Based Classification and Identification of Ransomware Variants Using Machine Learning. En 2018 17th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/ 12th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE) (pp. 1560–1564). New York, NY, USA: IEEE. Descargado 2022-01-23, de https://ieeexplore.ieee.org/document/8456093/ doi: 10.1109/TrustCom/BigDataSE.2018.00224

Ganta, V. G., Harish, G., Kumar, V., y Rao, G. K. (2020, noviembre). Ransomware Detection in Executable Files Using Machine Learning. En 2020 International Conference on Recent Trends on Electronics, Information, Communication & Technology (RTEICT) (pp. 282– 286). Bangalore, India: IEEE. Descargado 2022-01-23, de https://ieeexplore.ieee.org/document/9315672/ doi: 10.1109/RTEICT49044.2020.9315672

Hirano, M., y Kobayashi, R. (2019, octubre). Machine Learning Based Ransomware Detection Using Storage Access Patterns Obtained From Live-forensic Hypervisor. En 2019 Sixth International Conference on Internet of Things: Systems, Management and Security (IOTSMS) (pp. 1– 6). Granada, Spain: IEEE. Descargado 2022-01-23, de https://ieeexplore.ieee.org/document/8939214/ doi: 10.1109/IOTSMS48152.2019.8939214

IEEE. (2022). IEEE. Retrieved from https://www.ieee.org/publications/services/thesaurus.html

Khan, F., Ncube, C., Ramasamy, L. K., Kadry, S., y Nam, Y. (2020). A Digital DNA Sequencing Engine for Ransomware Detection Using Machine Learning. IEEE Access, 8, 119710–119719. Descargado 2022-01-23, de https://ieeexplore.ieee.org/document/9121260/ doi: 10.1109/ACCESS.2020.3003785

Kitchenham, B. (2004). Procedures for Performing Systematic Reviews. , 33.

Maniath, S., Ashok, A., Poornachandran, P., Sujadevi, V., Sankar A.U., P., y Jan, S. (2017, octubre). Deep learning LSTM based ransomware detection. En 2017 Recent Developments in Control, Automation & Power Engineering (RDCAPE) (pp. 442–446). Noida: IEEE. Descargado 2022-01-23, de https://ieeexplore.ieee.org/ document/8358312/ doi: 10 .1109/RDCAPE .2017.8358312

Manzano, C., Meneses, C., y Leger, P. (2020, noviembre). An Empirical Comparison of Supervised Algorithms for Ransomware Identification on Network Traffic. En 2020 39th International Conference of the Chilean Computer Science Society (SCCC) (pp. 1–7). Coquimbo, Chile: IEEE. Descargado 2022-01-23, de https:// ieeexplore.ieee.org/document/9281283/ doi: 10 .1109/SCCC51225.2020.9281283

Monje, G., y Alexander, R. (2018). SEGURIDAD INFORMÁTICA Y EL MALWARE. , 11.

Noorbehbahani, F., Rasouli, F., y Saberi, M. (2019). Analysis of machine learning techniques for ransomware detection. En 2019 16th international isc (iranian society of cryptology) conference on information security and cryptology (iscisc) (pp. 128–133).

Noorbehbahani, F., y Saberi, M. (2020, octubre). Ransomware Detection with Semi-Supervised Learning. En 2020 10th International Conference on Computer and Knowledge Engineering (ICCKE) (pp. 024–029). Mashhad, Iran: IEEE. Descargado 2022-01-23, de https:// ieeexplore.ieee.org/document/9303689/ doi: 10 .1109/ICCKE50421.2020.9303689

Parsifal. (2022). Parsifal. Retrieved from https://parsif.al/

Petticrew, M., y Roberts, H. (2008). Systematic Reviews in the Social Sciences: A Practical Guide. John Wiley & Sons. (Google-Books-ID: ZwZ1_xU3E80C)

Sahin, M., y Bahtiyar, S. (2020, noviembre). A Survey on Malware Detection with Deep Learning. En 13th International Conference on Security of Information and Networks (pp. 1–6). New York, NY, USA: Association for Computing Machinery. Descargado 2022-01-23, de https://doi.org/10.1145/3433174.3433609 doi: 10.1145/3433174.3433609

Sethi, K., Chaudhary, S. K., Tripathy, B. K., y Bera, P. (2017, octubre). A novel malware analysis for malware detection and classification using machine learning algorithms. En Proceedings of the 10th International Conference on Security of Information and Networks (pp. 107– 113). New York, NY, USA: Association for Computing Machinery. Descargado 2022-01-23, de https:// doi.org/10.1145/3136825.3136883 doi: 10.1145/ 3136825.3136883

Sharma, P., Chaudhary, K., Khan, M., y Wagner, M. (2019, diciembre). Ransomware Noise Identification and Eviction Through Machine Learning Fundamental Filters. En 2019 IEEE Asia-Pacific Conference on Computer Science and Data Engineering (CSDE) (pp. 1–8). Melbourne, Australia: IEEE. Descargado 2022-01-23, de https:// ieeexplore.ieee.org/document/9162376/ doi: 10.1109/CSDE48274.2019.9162376

Sharma, S., Krishna, C. R., y Kumar, R. (2020, noviembre). Android Ransomware Detection using Machine Learning Techniques: A Comparative Analysis on GPU and CPU. En 2020 21st International Arab Conference on Information Technology (ACIT) (pp. 1–6). Giza, Egypt: IEEE. Descargado 2022-01-23, de https://ieeexplore.ieee.org/document/9300108/ doi: 10.1109/ACIT50332 .2020.9300108

Sharma, S., Krishna, C. R., y Kumar, R. (2021, junio). RansomDroid: Forensic analysis and detection of Android Ransomware using unsupervised machine learning technique. Forensic Science International: Digital Investigation, 37, 301168. Descargado 2022-01-23, de https://linkinghub.elsevier.com/retrieve/pii/S2666281721000767 doi: 10.1016/j.fsidi.2021.301168

Shaukat, S. K., y Ribeiro, V. J. (2018, enero). RansomWall: A layered defense system against cryptographic ransomware attacks using machine learning. En 2018 10th International Conference on Communication Systems & Networks (COMSNETS) (pp. 356–363). Bengaluru: IEEE. Descargado 2022-01-23, de http://ieeexplore.ieee.org/document/8328219/ doi: 10.1109/COMSNETS .2018.8328219

Siłka, J. (2021). Bidirectional long short-term memory classifier assist for intelligent ransomware detection in Android OS. En (Vol. 2915, pp. 45–53). (ISSN: 1613-0073)

Su, D., Liu, J., Wang, X., y Wang, W. (2019). Detecting Android Locker-Ransomware on Chinese Social Networks. IEEE Access, 7, 20381–20393. Descargado 2022-01-23, de https://ieeexplore.ieee.org/document/8580446/ doi: 10.1109/ACCESS.2018.2888568

Takeuchi, Y., Sakai, K., y Fukumoto, S. (2018, agosto). Detecting Ransomware using Support Vector Machines. En Proceedings of the 47th International Conference on Parallel Processing Companion (pp. 1–6). Eugene OR USA: ACM. Descargado 2022-01-23, de https:// dl.acm.org/doi/10.1145/3229710.3229726 doi: 10.1145/3229710.3229726

Veloz, F. D. B., López, L. I. B., Valdivieso, L., y Álvarez, M. B. H. (2020). Indicadores para la detección de ataques. , 15.

Verma, M., Kumarguru, P., Brata Deb, S., y Gupta, A. (2018, noviembre). Analysing Indicator of Compromises for Ransomware: Leveraging IOCs with Machine Learning Techniques. En 2018 IEEE International Conference on Intelligence and Security Informatics (ISI) (pp. 154– 159). Miami, FL: IEEE. Descargado 2022-01-23, de https://ieeexplore.ieee.org/document/8587409/ doi: 10.1109/ISI.2018.8587409

Victoriano, O. B. (2019, octubre). Exposing Android Ransomware using Machine Learning. En Proceedings of the 2019 International Conference on Information System and System Management (pp. 32–37). Rabat Morocco: ACM. Descargado 2022-01-23, de https://dl.acm.org/doi/10.1145/3394788.3394923 doi: 10.1145/3394788 .3394923

Wan, Y.-L., Chang, J.-C., Chen, R.-J., y Wang, S.-J. (2018, abril). Feature-Selection-Based Ransomware Detection with Machine Learning of Data Analysis. En 2018 3rd International Conference on Computer and Communication Systems (ICCCS) (pp. 85–88). Nagoya, Japan: IEEE. Descargado 2022-01-23, de https://ieeexplore.ieee .org/document/8463300/ doi: 10.1109/CCOMS.2018 .8463300

Zhang, H., Xiao, X., Mercaldo, F., Ni, S., Martinelli, F., y Sangaiah, A. K. (2019, enero). Classification of ransomware families with machine learning based on N -gram of opcodes. Future Generation Computer Systems, 90, 211– 221. Descargado 2022-01-23, de https://linkinghub.elsevier.com/retrieve/pii/S0167739X18307325doi:10.1016/j.future.2018.07.052

Descargas

Publicado

2022-07-04
Estadísticas
Resumen 78

Cómo citar

Cumbicus Pineda, O. M., Ludeña Preciado, P. V., & Neyra Romero, L. A. (2022). Técnicas de machine Learning para la detección de Ransomware: Revisión sistemática de Literatura. Journal of Science and Research, 7(3), 32–60. Recuperado a partir de https://revistas.utb.edu.ec/index.php/sr/article/view/2684

Número

Sección

Artículo de Investigación