Loading...
Talos: a prototype Intrusion Detection and Prevention system for profiling ransomware behaviour
Wood, Ashley Eze, Thaddeus Speakman, Lee
Wood, Ashley
Eze, Thaddeus
Speakman, Lee
Advisors
Editors
Other Contributors
Affiliation
EPub Date
Publication Date
2021-06-24
Submitted Date
Collections
Files
Loading...
Main article
Adobe PDF, 667.05 KB
Other Titles
Abstract
Abstract: In this paper, we profile the behaviour and functionality of multiple recent variants of WannaCry and CrySiS/Dharma, through static and dynamic malware analysis. We then analyse and detail the commonly occurring behavioural features of ransomware. These features are utilised to develop a prototype Intrusion Detection and Prevention System (IDPS) named Talos, which comprises of several detection mechanisms/components. Benchmarking is later performed to test and validate the performance of the proposed Talos IDPS system and the results discussed in detail. It is established that the Talos system can successfully detect all ransomware variants tested, in an average of 1.7 seconds and instigate remedial action in a timely manner following first detection. The paper concludes with a summarisation of our main findings and discussion of potential future works which may be carried out to allow the effective detection and prevention of ransomware on systems and networks.
Citation
Wood, A., Eze, T., & Speakman, L. (2021). Talos: A prototype intrusion detection and prevention system for profiling ransomware behaviour. In T. Eze (Ed.), ECCWS 2021 - Proceeding of the 20th European Conference on Cyber Warfare and Security (pp. 558-568). Chester, United Kingdom: ACI.
Publisher
Academic Conferences International
Journal
Research Unit
DOI
PubMed ID
PubMed Central ID
Type
Conference Contribution
Language
Description
Series/Report no.
ISSN
EISSN
ISBN
9781912764990