Cyberthreat Hunting - Part 2: Tracking Ransomware Threat Actors using Fuzzy Hashing and Fuzzy C-Means Clustering

Nitin Naik, Paul Jenkins, Nick Savage, Longzhi Yang

Research output: Contribution to conferencePaperpeer-review

11 Citations (Scopus)
17 Downloads (Pure)

Abstract

Threat actors are constantly seeking new attack surfaces, with ransomeware being one the most successful attack vectors that have been used for financial gain. This has been achieved through the dispersion of unlimited polymorphic samples of ransomware whilst those responsible evade detection and hide their identity. Nonetheless, every ransomware threat actor adopts some similar style or uses some common patterns in their malicious code writing, which can be significant evidence contributing to their identification. The first step in attempting to identify the source of the attack is to cluster a large number of ransomware samples based on very little or no information about the samples, accordingly, their traits and signatures can be analysed and identified. Therefore, this paper proposes an efficient fuzzy analysis approach to cluster ransomware samples based on the combination of two fuzzy techniques fuzzy hashing and fuzzy c-means (FCM) clustering. Unlike other clustering techniques, FCM can directly utilise similarity scores generated by a fuzzy hashing method and cluster them into similar groups without requiring additional transformational steps to obtain distance among objects for clustering. Thus, it reduces the computational overheads by utilising fuzzy similarity scores obtained at the time of initial triaging of whether the sample is known or unknown ransomware. The performance of the proposed fuzzy method is compared against k-means clustering and the two fuzzy hashing methods SSDEEP and SDHASH which are evaluated based on their FCM clustering results to understand how the similarity score affects the clustering results.
Original languageEnglish
Publication statusPublished - 7 Mar 2019
Event2019 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE) - JW Marriot New Orleans, New Orleans, United States
Duration: 23 Jun 201926 Jun 2019

Conference

Conference2019 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE)
Abbreviated titleFUZZ-IEEE 2019
CountryUnited States
CityNew Orleans
Period23/06/1926/06/19

Fingerprint Dive into the research topics of 'Cyberthreat Hunting - Part 2: Tracking Ransomware Threat Actors using Fuzzy Hashing and Fuzzy C-Means Clustering'. Together they form a unique fingerprint.

Cite this