ICACT20210191 Question.1
Questioner: James_Lan@htx.gov.sg 2021-02-08 오후 8:54:36 |
ICACT20210191 Answer.1
Answer by Auhor iglee@sungshin.ac.kr 2021-02-08 오후 8:54:36
Chrome  Click!! |
| Hi, thanks for the sharing.
What are your views on whether the EDR tools could detect the type of encryption used the ransomware ?
Thanks. |
Hello. Thank you for the question. It is possible to predict some of which ransomware was used and which encryption algorithm was used through the extension of a file infected with ransomware, but it is unclear whether it is possible to determine the type of encryption algorithm by other methods, so I think I should look for it. |
ICACT20210191 Question.2
Questioner: debiii@naver.com 2021-02-09 오후 8:00:15 |
ICACT20210191 Answer.2
Answer by Auhor iglee@sungshin.ac.kr 2021-02-09 오후 8:00:15
Chrome Click!! |
| Thank you for the slides. How and where was the ransomware's data collected? |
Hello. Thank you for the question. We used RAASNet (https://github.com/leonv024/RAASNet) ransomware from GitHub. |
ICACT20210191 Question.3
Questioner: jjyoo@etri.re.kr 2021-02-09 오후 8:14:34 |
ICACT20210191 Answer.3
Answer by Auhor iglee@sungshin.ac.kr 2021-02-09 오후 8:14:34
Chrome Click!! |
| Among your proposed three types of EDR tools, which is the most desirable ransomware detection method in terms of accuracy and performance? |
Hello. Thank you for the question.
In terms of accuracy and performance, 'osquery' detected ransomware accurately and quickly in the environment we tested.
However, I think the performance of 'GRR' can be better than 'osquery' in a large system. |
