본문 바로가기
  • Home

Cryptography Module Detection and Identification Mechanism on Malicious Ransomware Software

  • Journal of Internet of Things and Convergence
  • Abbr : JKIOTS
  • 2023, 9(1), pp.1-7
  • DOI : 10.20465/KIOTS.2023.9.1.001
  • Publisher : The Korea Internet of Things Society
  • Research Area : Engineering > Computer Science > Internet Information Processing
  • Received : October 28, 2022
  • Accepted : December 8, 2022
  • Published : February 28, 2023

Lee, Hyung Woo 1

1한신대학교

Accredited

ABSTRACT

Cases in which personal terminals or servers are infected by ransomware are rapidly increasing. Ransomware uses a self-developed encryption module or combines existing symmetric key/public key encryption modules to illegally encrypt files stored in the victim system using a key known only to the attacker. Therefore, in order to decrypt it, it is necessary to know the value of the key used, and since the process of finding the decryption key takes a lot of time, financial costs are eventually paid. At this time, most of the ransomware malware is included in a hidden form in binary files, so when the program is executed, the user is infected with the malicious code without even knowing it. Therefore, in order to respond to ransomware attacks in the form of binary files, it is necessary to identify the encryption module used. Therefore, in this study, we developed a mechanism that can detect and identify by reverse analyzing the encryption module applied to the malicious code hidden in the binary file.

Citation status

* References for papers published after 2023 are currently being built.

This paper was written with support from the National Research Foundation of Korea.