LooCipher Ransomware Detection Using Lightweight Packet Characteristics
Te-Min Liu, Da‐Yu Kao, Yun-Ya Chen
Abstract
Ransomware activities have been rising steadily. The network traffic characteristics in a network packet analysis are available immediately to explore anomalies and find any offensive behaviors. This paper applies a lightweight ICEAP (Identify-Collect-Examine-Analyze-Present) approach for effectively identifying LooCipher ransomware activities instead of establishing complex systems or creating various programs. This proposed approach tracks online behaviors and understands the source/destination entities. With this innovative detection method, analysts can merge the eigenvalues into security mechanisms, uncover network threats by analyzing the full payload, and detect infected ransomware in a minimum effort.