摘要
针对隐遁勒索病毒攻击威胁性极大以及传统方法对其防御不力的问题,该文提出了一种基于数字疫苗的隐遁勒索病毒攻击动态防御模型。借鉴生物免疫机理,给出了数字疫苗、抗原、抗体及抗体浓度等免疫概念的形式化定义。首先,通过接种数字疫苗(创建诱饵文件和文件夹),使系统生成抵御隐遁勒索病毒攻击的未成熟抗体;其次,通过免疫抗体动态演化机制,生成能抵御隐遁勒索病毒抗原的成熟抗体与记忆抗体;最后,通过在内核层和应用层实施双重动态监控抗体浓度变化,并借助交叉视图法来实时感知隐遁勒索病毒攻击。理论分析与实验结果表明:该模型有效解决了隐遁勒索病毒攻击难以实时检测的问题,且较传统方法性能更高。
Ransomware is a type of malware from cryptovirology that threatens to publish the victim’s data or permanently block access to it unless a ransom is paid. Stealthy ransomware is a new type of ransomware that tries to evade detection by deleting all hard copies of its files and just residing in a process running in memory. This study uses danger theory for the biological immune system to design a digital vaccine-based dynamic defense model for stealthy ransomware attacks. Formal definitions are given for some immune concepts such as digital vaccine, antigen, antibody and antibody concentration. Vaccinations with digital vaccines(creating bait files and folders) give the system immature antibodies against stealthy ransomware attacks. The system quickly detects stealthy ransomware attacks using dynamic monitoring of the stealthy ransomware attack antigens in both the core and application layers and by monitoring the dynamic evolution of antibodies and changes of the antibody concentration. Analyses and tests show that the model provides effective real-time detection of stealthy ransomware attacks that are more effective than traditional methods.
作者
张瑜
刘庆中
石元泉
曹均阔
ZHANG Yu;LIU Qingzhong;SHI Yuanquan;CAO Junkuo(Department of Computer Science,Hainan Normal University,Haikou 571158,China;Department of Computer Science,Sam Houston State University,Houston 77340,USA;School of Computer Science and Engineering,Huaihua University,Huaihua 418000,China)
出处
《清华大学学报（自然科学版）》
EI
CAS
CSCD
北大核心
2020年第5期402-407,共6页
Journal of Tsinghua University(Science and Technology)
基金
国家自然科学基金资助项目(61862022,61462025,61262077)
海南省重点研发计划资助项目(ZDYF2016013)
海南省重大科技计划资助项目(ZDKJ2O17O12)
湖南省教育厅重点资助项目(18A449)。
关键词
数字疫苗
免疫危险理论
隐遁勒索病毒攻击
危险信号
抗体浓度
digital vaccine
immune danger theory
stealthy ransomware attacks
danger signals
antibody concentration
