Akashdeep Bhardwaj ¹, Vinay Avasthi ¹, Hanumat Sastry ², G. V. B. Subrahmanyam ³

Affiliations
1 UPES, Dehradun - 248007, Uttarakhand, IN
2 UPES, Dehradun - 248007, Uttarakhand
3 Tech Mahindra, Hyderabad, Andhra Pradesh, IN

Abstract

Imagine what would happen if you were stopped from accessing your own files or accessing your own computer system. Now imagine further if to get back the access someone demanded ransom amount from you. Globally increasingly social interactions and financial transactions involve few critical aspects such as digital data, computing device and the internet. This is an area where Ransomware has spread and become a major concern against digital extortion in the form of a new age threat vector to corporates and end users alike. This paper presents the various ways and methods adopted by cyber criminals against Ransomware and present an anti-malware detection system. Background/Objectives: The impact of Ransomware has caused immense damage to end users and corporates alike. Access to authorized data being blocked and being released only after the ransom demand has been mate, is a new age digital extortion has which holds promise as a viable option against the cyber-attacks on user systems, mobiles and handhelds. Methods/Statistical Analysis: The authors reviewed existing Crypto and Locker ransomware, studying their propagation, attack techniques and new emerging threat vectors as file Encryption Ransomware, Screen Lock Ransomware, Windows & Browser Lock, Pop Advertisements and URL Redirection. The authors also designed and tested cloud based malware detection system, performing comparison evaluation with and without the proposed anti-malware solution in form of sandboxes, so even if the environment got compromised, it could be easily decommissioned and rebuilt from a fresh clean virtual snapshots. The system comprised of three virtual environments running services for Malware Behavioral Analysis, Malware Code Analysis and Malware Reporting. Open source and commercial tools were used in each of the three environments. Malware Behavioral environment for analyzing malware for before and after receiving malware payload files and logs from infected user devices. Malware Code Analysis gathered assembly code and memory dumps from memory and performed analysis on malware payload instructions. The Reporting environment analyzed Web URL proactively for malicious sites hosting malware code or payloads and also checked the user system and devices for before and after analysis logs. Findings: When comparing to the standard antivirus scanners that rely on signatures, the proposed malware detection and alerting process has better malware mitigation results and advantages. The Anti-Malware scanning security apart from being a cloud service with the secure scanners operating from cloud platforms display a high level of resilience. Being a Cloud application has the standard cloud feature advantages of being elastic, scalable, pay-as-you-use, user driven cloud model. This model can also help in saving costs by promoting the BYOD concept. Application/Improvements: The Anti-Malware cloud model can be modified to offer specific payload blocking for different customers even as other customers of that very application program are able to access them and even benefit from experience of the infected customers. This model can be scale up dynamically as required.

Keywords

Bitcoin, Crypto, Extortion, Locker, Malware, Ransomware

Full Text

   

Akashdeep Bhardwaj ¹, G. V. B. Subrahmanyam ¹, Vinay Avasthi ¹, Hanumat Sastry ¹

Affiliations
1 University of Petroleum and Energy Studies (UPES), Dehradun - 248007, Uttarakhand, IN

Abstract

The information security policy development life cycle tend to lack focus on use of standard terms and semantics. This results in blurred outlines for monitoring, evaluation and enforcement of the security policy for the employees causing confusion in adhering and implementing it which leads to lack of process of publishing form the security policy, end user awareness, translation of high level policy to lowest level component configuration plans and actions to take in time of crisis. This leads to the critical need for the designing an empirically tested, comprehensive security policy design. This paper proposes bridging the gap between the high level information security policy descriptions with the low level network infrastructure security implementation. Background Objectives: With new and innovative technologies such as Cloud, Remote computing, Enterprise Mobility, e-commerce on the rise, network security has remained an ever increasing challenge. This paper presents a security framework to bridge the gap between high level specification requirements and the low level implementation phase for network infrastructure security using the network architecture model with the security policies associated with the network components required to be enforced. Methods/Statistical Analysis: To achieve the framework design, architectural model and a set of design-level security policies are taken into consideration. Also discussed are the advantages and desired characteristics of the model, relating to existing process worked in the design area; and future research directions are pointed. Findings: The current information security policy development life cycle tends to have few disadvantages with the most critical being the overall lack of view of the policy. Typically a narrow view can be found when focusing only on development of the security policy documents and not including the actual practices for implementation or even maintenance of the security policies. This process does not address how the security policy would be development and enforced or even evaluated. The life cycle designs usually focus on policy for development instead of focusing on development process of the information security policy. Application: Utilizing Hybrid cloud architecture design so that internet facing tiers tend to be public clouds and internal secure applications and database tend to be private clouds. This change in network architecture helps take on the volumetric network and application layer DDoS attacks to ensure the traffic reaching the internal network tiers is free from such attackers. Using Rate controls, built-in intelligent WAFs, Client Reputation monitoring, be used in combination as part of a comprehensive defense against all types and sizes of cyber threats.

Keywords

Information Security Policy, Network Architecture, Network Firewall, Network Infrastructure, Network Security Policy, WAF.

Full Text