Volume 14, Issue 3 (9-2022)                   2022, 14(3): 27-36 | Back to browse issues page

‎ 10.52547/itrc.14.3.27

XML Print

Ransomware Modeling Based on a Process Mining Approach
Ebrahim Mahdipour 1, Ali Aghamohammadpour2 , Iman Attarzadeh3
1- Department of Computer Engineering, Science and Research Branch, Islamic Azad University, Tehran, Iran , e.mahdipour@gmail.com
2- Department of Computer Engineering, Science and Research Branch, Islamic Azad University, Tehran, Iran
3- Department of Computer Engineering, Faculty of Engineering, Central Tehran Branch, Islamic Azad University, Tehran, Iran
Abstract:   (1024 Views)
Ransomware attacks are taking advantage of the ongoing coronavirus pandemics and attacking the vulnerable systems in the health sector. Modeling ransomware attacks help to identify and simulate attacks against security environments, using likely adversary techniques. Process Mining (PM) is a field of study that focuses on analyzing process logs linked with the execution of the processes of a system to acquire insight into the variety of characteristics of how the functions behave. This paper presents a PM conformance-based approach to determining ransomware processes. First, frequent ransomware techniques were identified using state-of-the-art MITRE ATT&CK. Then, a model was developed to gather ransomware techniques using a process-based approach. The PM-based Prom tool is used to check the conformance of malware processes alongside the presented model to illustrate its efficiency. The model can identify chain processes associated with ransom-related behaviors. In this study, the presented model was evaluated using thirty common malwares in the healthcare industry. The approach demonstrates that this model could successfully classify ninety percent of malware instances as ransomware and non-ransomware. Finally, guidelines for future research are provided. We believe the proposed method will uncover behavioral models that will enable us to hunt ransomware threats.
Keywords: Process Mining, Ransomware Hunting, Threat Modeling, Threat Intelligence, Threat Hunting.
Full-Text [PDF 1206 kb]   (509 Downloads)    
Type of Study: Research | Subject: Information Technology
Rights and permissions
Creative Commons License This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.