Ransomware behavioural analysis on windows platforms

Nikolai Hampton; Zubair Baig; Sherali Zeadally

doi:10.1016/j.jisa.2018.02.008

Ransomware behavioural analysis on windows platforms

Nikolai Hampton, Zubair Baig, Sherali Zeadally

School of Information Science

Research output: Contribution to journal › Article › peer-review

98 Scopus citations

Abstract

Ransomware infections have grown exponentially during the recent past to cause major disruption in operations across a range of industries including the government. Through this research, we present an analysis of 14 strains of ransomware that infect Windows platforms, and we do a comparison of Windows Application Programming Interface (API) calls made through ransomware processes with baselines of normal operating system behaviour. The study identifies and reports salient features of ransomware as referred through the frequencies of API calls.

Original language	English
Pages (from-to)	44-51
Number of pages	8
Journal	Journal of Information Security and Applications
Volume	40
DOIs	https://doi.org/10.1016/j.jisa.2018.02.008
State	Published - Jun 2018

Bibliographical note

Publisher Copyright:
© 2018 Elsevier Ltd

Keywords

Cryptovirology
Cybersecurity
Intrusion detection
Malware
Ransomware
Win/32

ASJC Scopus subject areas

Software
Safety, Risk, Reliability and Quality
Computer Networks and Communications

Access to Document

10.1016/j.jisa.2018.02.008

Cite this

@article{8141fdc8da174a99ad6cf7ab86b345a1,

title = "Ransomware behavioural analysis on windows platforms",

abstract = "Ransomware infections have grown exponentially during the recent past to cause major disruption in operations across a range of industries including the government. Through this research, we present an analysis of 14 strains of ransomware that infect Windows platforms, and we do a comparison of Windows Application Programming Interface (API) calls made through ransomware processes with baselines of normal operating system behaviour. The study identifies and reports salient features of ransomware as referred through the frequencies of API calls.",

keywords = "Cryptovirology, Cybersecurity, Intrusion detection, Malware, Ransomware, Win/32",

author = "Nikolai Hampton and Zubair Baig and Sherali Zeadally",

note = "Publisher Copyright: {\textcopyright} 2018 Elsevier Ltd",

year = "2018",

month = jun,

doi = "10.1016/j.jisa.2018.02.008",

language = "English",

volume = "40",

pages = "44--51",

}

TY - JOUR

T1 - Ransomware behavioural analysis on windows platforms

AU - Hampton, Nikolai

AU - Baig, Zubair

AU - Zeadally, Sherali

PY - 2018/6

Y1 - 2018/6

N2 - Ransomware infections have grown exponentially during the recent past to cause major disruption in operations across a range of industries including the government. Through this research, we present an analysis of 14 strains of ransomware that infect Windows platforms, and we do a comparison of Windows Application Programming Interface (API) calls made through ransomware processes with baselines of normal operating system behaviour. The study identifies and reports salient features of ransomware as referred through the frequencies of API calls.

AB - Ransomware infections have grown exponentially during the recent past to cause major disruption in operations across a range of industries including the government. Through this research, we present an analysis of 14 strains of ransomware that infect Windows platforms, and we do a comparison of Windows Application Programming Interface (API) calls made through ransomware processes with baselines of normal operating system behaviour. The study identifies and reports salient features of ransomware as referred through the frequencies of API calls.

KW - Cryptovirology

KW - Cybersecurity

KW - Intrusion detection

KW - Malware

KW - Ransomware

KW - Win/32

UR - http://www.scopus.com/inward/record.url?scp=85044009117&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85044009117&partnerID=8YFLogxK

U2 - 10.1016/j.jisa.2018.02.008

DO - 10.1016/j.jisa.2018.02.008

M3 - Article

AN - SCOPUS:85044009117

SN - 2214-2134

VL - 40

SP - 44

EP - 51

JO - Journal of Information Security and Applications

JF - Journal of Information Security and Applications

ER -

Ransomware behavioural analysis on windows platforms

Abstract

Bibliographical note

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this