Análisis de correlación automática para detección de ataques ransomware en ambiente de pruebas

Abstract

The document proposes the implementation of a controlled environment in which dynamic analyzes are performed to obtain information on the behavior of said malware. At the same time, a machine learning model is proposed in which attributes obtained from the ransomware analysis are filtered. In chapter one, we talk about the proposed problem and the state of the art, both for ransomware and for dynamic analysis tools. Also included is a definition of machine learning and the set of algorithms that are used. Chapter two discusses the implementation of the controlled environment that uses a sandbox called Cuckoo Sandbox, which is a malware analysis system. This chapter also covers obtaining ransomware samples. The implementation of tools that help the ransomware analysis and the creation of the machine learning model are exposed. Chapter three explains the results obtained in different analyzes of the CryptoLocker and WannaCry ransomware samples in Windows XP and Windows 7 operating systems. The results are taken from the reports generated by Cuckoo Sandbox and are filtered in the tool for the creation of the automatic learning model.