 |
As ransomware attacks increase and diversify, research on detecting and defending ransomware continues. The first part is digital forensics. Digital forensics is a scientific investigation technique that analyzes digital evidence and uses it for investigation. One of the related studies is ˇ°Software-defined networking-based crypto ransomware detection using HTTP traffic characteristicsˇ±. This study proposes a network-based detection approach that utilizes the characteristics of ransomware communication by analyzing the sequence of HTTP messages and the content of each message. However, in the case of command and control servers, which are mainly used for malicious attacks, HTTP response sizes are often not considered, so there is a limit to the actual usability. |
IEEE/ICACT20210191 Slide.04
[Big Slide]