Similarity Analysis of Ransomware Attacks Based on ATT&CK Matrix
In recent years, there has been an increasingly prevalent trend of ransomware attacks, with malicious organizations employing various techniques to gain system privileges and subsequently engaging in extortion through methods such as encrypting files or leaking information. Current research predomin...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2023-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/10273710/ |
| _version_ | 1797659049780576256 |
|---|---|
| author | Zheyu Song Yonghong Tian Junjin Zhang |
| author_facet | Zheyu Song Yonghong Tian Junjin Zhang |
| author_sort | Zheyu Song |
| collection | DOAJ |
| description | In recent years, there has been an increasingly prevalent trend of ransomware attacks, with malicious organizations employing various techniques to gain system privileges and subsequently engaging in extortion through methods such as encrypting files or leaking information. Current research predominantly focuses on the analysis of ransomware using existing features, but there has been scarce exploration of the behavioral patterns associated with ransomware attacks. In light of this situation, we propose a ransomware attack similarity analysis method based on the ATT&CK matrix. To initiate this analysis, a substantial amount of network threat intelligence is sifted through to select reliable and comprehensive ransomware attack incidents. From these incidents, we extract attack tactics, techniques, and procedural information. Subsequently, we employ the TF-IDF algorithm to calculate the keyword weights within attack descriptions. Based on these weights, we utilize the cosine similarity algorithm to compare the similarity between attack events. This approach reveals critical technical and tactical information employed by the attacking organizations, enabling researchers to gain a deeper understanding of the behavioral patterns of the attackers. Finally, we propose countermeasures corresponding to the critical attack techniques employed by these malicious organizations. These countermeasures aim to enhance network security defenses and reduce the risks associated with ransomware attacks. |
| first_indexed | 2024-03-11T18:09:19Z |
| format | Article |
| id | doaj.art-75d379399a0c4fd39f78f9a550845e65 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-03-11T18:09:19Z |
| publishDate | 2023-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-75d379399a0c4fd39f78f9a550845e652023-10-16T23:00:32ZengIEEEIEEE Access2169-35362023-01-011111137811138810.1109/ACCESS.2023.332242710273710Similarity Analysis of Ransomware Attacks Based on ATT&CK MatrixZheyu Song0https://orcid.org/0000-0003-3723-5914Yonghong Tian1Junjin Zhang2College of Data Science and Applications, Inner Mongolia University of Technology, Hohhot, ChinaCollege of Data Science and Applications, Inner Mongolia University of Technology, Hohhot, ChinaCollege of Data Science and Applications, Inner Mongolia University of Technology, Hohhot, ChinaIn recent years, there has been an increasingly prevalent trend of ransomware attacks, with malicious organizations employing various techniques to gain system privileges and subsequently engaging in extortion through methods such as encrypting files or leaking information. Current research predominantly focuses on the analysis of ransomware using existing features, but there has been scarce exploration of the behavioral patterns associated with ransomware attacks. In light of this situation, we propose a ransomware attack similarity analysis method based on the ATT&CK matrix. To initiate this analysis, a substantial amount of network threat intelligence is sifted through to select reliable and comprehensive ransomware attack incidents. From these incidents, we extract attack tactics, techniques, and procedural information. Subsequently, we employ the TF-IDF algorithm to calculate the keyword weights within attack descriptions. Based on these weights, we utilize the cosine similarity algorithm to compare the similarity between attack events. This approach reveals critical technical and tactical information employed by the attacking organizations, enabling researchers to gain a deeper understanding of the behavioral patterns of the attackers. Finally, we propose countermeasures corresponding to the critical attack techniques employed by these malicious organizations. These countermeasures aim to enhance network security defenses and reduce the risks associated with ransomware attacks.https://ieeexplore.ieee.org/document/10273710/Cybersecuritycyber threat intelligenceransomware attacksimilarity comparisonMITRE ATT&CK |
| spellingShingle | Zheyu Song Yonghong Tian Junjin Zhang Similarity Analysis of Ransomware Attacks Based on ATT&CK Matrix IEEE Access Cybersecurity cyber threat intelligence ransomware attack similarity comparison MITRE ATT&CK |
| title | Similarity Analysis of Ransomware Attacks Based on ATT&CK Matrix |
| title_full | Similarity Analysis of Ransomware Attacks Based on ATT&CK Matrix |
| title_fullStr | Similarity Analysis of Ransomware Attacks Based on ATT&CK Matrix |
| title_full_unstemmed | Similarity Analysis of Ransomware Attacks Based on ATT&CK Matrix |
| title_short | Similarity Analysis of Ransomware Attacks Based on ATT&CK Matrix |
| title_sort | similarity analysis of ransomware attacks based on att x0026 ck matrix |
| topic | Cybersecurity cyber threat intelligence ransomware attack similarity comparison MITRE ATT&CK |
| url | https://ieeexplore.ieee.org/document/10273710/ |
| work_keys_str_mv | AT zheyusong similarityanalysisofransomwareattacksbasedonattx0026ckmatrix AT yonghongtian similarityanalysisofransomwareattacksbasedonattx0026ckmatrix AT junjinzhang similarityanalysisofransomwareattacksbasedonattx0026ckmatrix |