Volume 14, Issue 3 (9-2022)                   itrc 2022, 14(3): 27-36 | Back to browse issues page

XML Print

Download citation:
BibTeX | RIS | EndNote | Medlars | ProCite | Reference Manager | RefWorks
Send citation to:
Mahdipour E, Aghamohammadpour A, Attarzadeh I. Ransomware Modeling Based on a Process Mining Approach. itrc 2022; 14 (3) :27-36
URL: http://journal.itrc.ac.ir/article-1-523-en.html
Ransomware Modeling Based on a Process Mining Approach
Ebrahim Mahdipour 1, Ali Aghamohammadpour2 , Iman Attarzadeh3
1- Department of Computer Engineering, Science and Research Branch, Islamic Azad University, Tehran, Iran , e.mahdipour@gmail.com
2- Department of Computer Engineering, Science and Research Branch, Islamic Azad University, Tehran, Iran
3- Department of Computer Engineering, Faculty of Engineering, Central Tehran Branch, Islamic Azad University, Tehran, Iran
Abstract:   (1715 Views)
Ransomware attacks are taking advantage of the ongoing coronavirus pandemics and attacking the vulnerable systems in the health sector. Modeling ransomware attacks help to identify and simulate attacks against security environments, using likely adversary techniques. Process Mining (PM) is a field of study that focuses on analyzing process logs linked with the execution of the processes of a system to acquire insight into the variety of characteristics of how the functions behave. This paper presents a PM conformance-based approach to determining ransomware processes. First, frequent ransomware techniques were identified using state-of-the-art MITRE ATT&CK. Then, a model was developed to gather ransomware techniques using a process-based approach. The PM-based Prom tool is used to check the conformance of malware processes alongside the presented model to illustrate its efficiency. The model can identify chain processes associated with ransom-related behaviors. In this study, the presented model was evaluated using thirty common malwares in the healthcare industry. The approach demonstrates that this model could successfully classify ninety percent of malware instances as ransomware and non-ransomware. Finally, guidelines for future research are provided. We believe the proposed method will uncover behavioral models that will enable us to hunt ransomware threats.
Keywords: Process Mining, Ransomware Hunting, Threat Modeling, Threat Intelligence, Threat Hunting.
Full-Text [PDF 1206 kb]   (843 Downloads)    
Type of Study: Research | Subject: Information Technology
Add your comments about this article : Your username or Email:
CAPTCHA
Send email to the article author

Rights and permissions
Creative Commons License This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.