DeepWare: Imaging Performance Counters with Deep Learning to Detect Ransomware

Gaddisa Olani, Chun Feng Wu, Yuan Hao Chang, Wei Kuan Shih

研究成果: Article同行評審

1 引文 斯高帕斯(Scopus)

摘要

In the year passed, rarely a month passes without a ransomware incident published in a newspaper or social media. In addition to the rise in the frequency of ransomware attacks, emerging attacks are very effective as they utilize sophisticated techniques to bypass existing organizational security perimeter. Toward this issue, this paper presents "DeepWare," a simple yet effective concept of imaging hardware performance counters with deep learning to detect ransomware, to identify ransomware efficiently and effectively. By imaging the HPC values and restructuring the conventional CNN model, DeepWare can address HPCs nondeterminism issue by extracting the event-specific and event-wise behavioral features, which allows it to distinguish the ransomware activity from the benign one effectively. The experiment results across ransomware families show that the proposed DeepWare is effective at detecting different classes of ransomware with the highest detection accuracy, which is 30% and 76% improvement over the two baseline models. It achieves an astounding recall score and nearly zero false-positive rates using just a 100 ms snapshot of HPC data. This timeliness of DeepWare is critical on the ground that organizations and individuals have the opportunity to take countermeasures in the first stage of the attack.

原文English
頁(從 - 到)1
頁數1
期刊IEEE Transactions on Computers
DOIs
出版狀態Accepted/In press - 2022

指紋

深入研究「DeepWare: Imaging Performance Counters with Deep Learning to Detect Ransomware」主題。共同形成了獨特的指紋。

引用此