Abstract-Attacks of Ransomware are increasing; this form of malware bypasses many technical solutions by leveraging social engineering methods. This means established methods of perimeter defence need to be supplemented with additional systems. Honeypots are bogus computer resources deployed by network administrators to act as decoy computers and detect any illicit access. This study investigated whether a honeypot folder could be created and monitored for changes. The investigations determined a suitable method to detect changes to this area. This research investigated methods to implement a honeypot to detect ransomware activity, and selected two options, the File Screening service of the Microsoft File Server Resource Manager feature and EventSentry to manipulate the Windows Security logs. The research developed a staged response to attacks to the system along with thresholds when there were triggered. The research ascertained that witness tripwire files offer limited value as there is no way to influence the malware to access the area containing the monitored files. Keywords-honeypot; ransomware; malware; computer security; cyber security, network, detect, activity OVERVIEW AND PROBLEM STATEMENT Cyber-extortion [1] methods can be traced back to the late 1980s. However the reports of the modern wave of ransomware begin in 2005 [2], this is a form of malicious software (malware) that hackers are spreading with the intent of not just destroying data as traditional attacks; but encrypting and charging for the service to recover the data. Ransomware is variety of scareware, this is when the user is prompted to pay the ransom in reaction in fear of losing their data. This occurrence of this variation of malware is on the increase [3]. This is a profitable business model for the criminal organisations that orchestrate the attacks. Payment is often via bitcoin, with requests in the region of 500 -1000 USD. This 'affordable' price is set to increase as time goes on, making it look attractive to pay early. This is a lucrative business for the cybercriminals, one calculation [4] suggests the figure of 200 million USD per year is extorted by the criminal gangs. Advice is often given not to pay the ransom, as this perpetuates the criminal business model, however it may be the only way to recover lost data. As the ransomware threat evolves, different varieties of the malware progress, some names are well known, such as CryptoLocker and CryptoWall, in recent times TeslaCrypt and Locky have appeared. Detection of malware before it begins its payload of encrypting files is difficult; traditional antivirus products need to collect a sample of malware, analyse it, and deploy the updates to the virus signature files to the protected machines, Figure 1 . illustrates how after several days of a new attack being circulated, only half of anti-virus vendors provide protection for this attack. As traditional antivirus software cannot detect new forms of malware quickly enough to protect systems, there is a need to detect when ransomware begins to activate and block further damage. A possible solution could be a honeypot [6] , that is a computer system deployed specifically to detect unauthorised use of a resource. As the honeypot system does not expect any legitimate connections, any interaction would be considered as an attack on the system. This information would be used to raise an alert of an attack This research looks into how honeypot principles could be utilised to detect and possible mitigate a ransomware attack on a Microsoft Windows network. Microsoft [7] advice on tackling ransomware is that a tested reliable backup regime is the best way to mitigate the damage from a ransomware attack. While antivirus is still advocated, as we have seen, this may not be updated soon enough to block an attack. Microsoft also suggest AppLocker to block programs from running in common places, this is good advice for computers on a managed domain. However, there is still a possibility of new variants 2016 Cybersecurity and Cyberforensics Conference
Fake files are also utilized to detect ransomware REF .
Detecting Ransomware with Honeypot Techniques
2016 Cybersecurity and Cyberforensics Conference (CCC)
2016 Cybersecurity and Cyberforensics Conference (CCC)
Computer Science