SCIENCE@home

Automatically Traceback RDP-Based Targeted Ransomware Attacks

Zihan Wang,Chaoge Liu,Jing Qiu,Zhihong Tian,Xiang Cui,Shen Su

Published 2018 in Wireless Communications and Mobile Computing

ABSTRACT

While various ransomware defense systems have been proposed to deal with traditional randomly-spread ransomware attacks (based on their unique high-noisy behaviors at hosts and on networks), none of them considered ransomware attacks precisely aiming at specific hosts, e.g., using the common Remote Desktop Protocol (RDP). To address this problem, we propose a systematic method to fight such specifically targeted ransomware by trapping attackers via a network deception environment and then using traceback techniques to identify attack sources. In particular, we developed various monitors in the proposed deception environment to gather traceable clues about attackers, and we further design an analysis system that automatically extracts and analyze the collected clues. Our evaluations show that the proposed method can trap the adversary in the deception environment and significantly improve the efficiency of clue analysis. Furthermore, it also helps us trace back RDP-based ransomware attackers and ransomware makers in the practical applications.

PUBLICATION RECORD

  • Publication year

    2018

  • Venue

    Wireless Communications and Mobile Computing

  • Publication date

    2018-12-06

  • Fields of study

    Computer Science

  • Identifiers
    DOI 10.1155/2018/7943586
  • External record

    Open on Semantic Scholar

  • Source metadata

    Semantic Scholar

CITATION MAP

EXTRACTION MAP

CLAIMS

  • No claims are published for this paper.

CONCEPTS

  • No concepts are published for this paper.

REFERENCES

Showing 1-30 of 30 references · Page 1 of 1

CITED BY

Showing 1-41 of 41 citing papers · Page 1 of 1