網路勒索病毒的特徵分析與知識本體模型建構

Using Signature Analyses to Construct an Ontological Model of Ransomware

林孝忠(Hsiao-Chung Lin) ； 王平(Ping Wang) ； 洪維謙(Wei-Qian, Hong)

《資訊安全通訊》 25卷2期 (2019/05) Pp. 37-58

摘要

近年隨著連網行動裝置與無線感測技術普遍化，帶動物聯網（Internet of Thing, IoT）與雲端服務的整合契機，通常物聯網設備使用精簡型的作業系統，無法安裝掃毒引擎，加上管理者缺乏持續的作業系統更新，容易產生資安漏洞並遭受攻擊，可以成為駭客攻擊的網路跳板，並造成企業或個人隱私資訊外洩！故本研究以樹莓派實作一個物聯網為基礎之智慧家庭的資網路防護系統，針對近期發生的勒索病毒（Ransomware）威脅，透過Cuckoo沙盒分析攻擊特徵（attack vectors），再運用正規化概念分析（Formal Concept Analysis, FCA）建構勒索病毒之知識本體模型（ontological model），其目的是希望能建立電腦病毒知識本體為一概念化的正規抽象模型，明確定義病毒與攻擊行為間之關聯，作為病毒類別與變種鑑定的參考依據，以強化析網路病毒防護與資安管理。

關鍵字

勒索病毒 ； 知識本體 ； 正規化概念分析 ； Cuckoo ； 攻擊特徵

並列摘要

The growing popularity of employing of the mobile device enables the development of the Internet of Thing (IoT). Generally, IoT devices use an embedded operating system, cannot completely install anti-virus engines, and uers have not continuously updated the operating system. Consequently, system vulnerabilities prone to attacks and may lead to the privacy of business or personal information leakage. Accordingly, the present study proposes an IoT-based security defence system with Raspberry Pi to analyse the attack vectors of Ransomware using Cuckoo malware dynamic analysis platform. Importantly, an ontology-based method for developing domain ontologies using Formal Concept Analysis (FCA) technique is proposed. Experimental data show that our model is capable of performing the missions including of i) explicitly identifying the relations between Ransomware and their malicious behavior , ii) categorizing the Ransomware and the variations, and (iii) assist manager analyse the security controls for virus protection from cyber threats.

並列關鍵字

Ransomware ； Ontology ； FCA ； Cuckoo ； Attack vector

參考文獻

https://zh.wikipedia.org/wiki/WannaCry (2018/7/28)

HoneyNet, “Cuckoo Sandbox”, https://github.com/ cuckoosandbox/cuckoo (2018/8/13)

Y. Nativ, “GitHub- ytisf/theZoo: A repository of LIVE malwares for your own joy and pleasure” https://github.com/ytisf/theZoo (2018/8/01)

Standard University, Protégé, https://protege.stanford.edu/(2018/7/11)

C. Willems, T. Holz, and F. Freiling, “Toward automated dynamic malware analysis using CWSandbox, ” IEEE Security & Privacy, vol. 5, no. 2, pp. 32-39, 2007.