WannaLaugh：一个可配置的勒索软件模拟器——学习模仿恶意存储痕迹
WannaLaugh: A Configurable Ransomware Emulator -- Learning to Mimic Malicious Storage Traces
AI总结：
本文提出可配置勒索软件模拟器WannaLaugh，通过安全模仿勒索软件攻击生成存储I/O痕迹以训练机器学习检测模型，并可模拟现有勒索软件行为实现安全痕迹收集，推动机器学习驱动的勒索软件检测发展。
摘要：
勒索软件是一种可怕且快速演变的网络安全威胁，持续对全球个人和组织造成严重后果。传统的检测方法依赖静态签名和应用程序行为模式，受到这些威胁动态特性的挑战。本文提出了三项主要贡献来应对这一挑战。首先，我们引入了一个勒索软件模拟器。该工具旨在安全地模仿勒索软件攻击，而不会造成实际危害或传播恶意软件，使其成为研究勒索软件行为的独特解决方案。其次，我们展示了如何使用该模拟器生成存储I/O痕迹。这些痕迹随后被用于训练机器学习模型。我们的结果表明，这些模型在检测勒索软件方面是有效的，凸显了我们的模拟器在开发负责任的网络安全工具中的实际应用。第三，我们展示了我们的模拟器如何被用来模仿现有勒索软件的I/O行为，从而实现安全的痕迹收集。该模拟器及其应用都代表了在机器学习驱动的网络安全时代勒索软件检测方面的重要进展。
英文摘要：
Ransomware, a fearsome and rapidly evolving cybersecurity threat, continues to inflict severe consequences on individuals and organizations worldwide. Traditional detection methods, reliant on static signatures and application behavioral patterns, are challenged by the dynamic nature of these threats. This paper introduces three primary contributions to address this challenge. First, we introduce a ransomware emulator. This tool is designed to safely mimic ransomware attacks without causing actual harm or spreading malware, making it a unique solution for studying ransomware behavior. Second, we demonstrate how we use this emulator to create storage I/O traces. These traces are then utilized to train machine-learning models. Our results show that these models are effective in detecting ransomware, highlighting the practical application of our emulator in developing responsible cybersecurity tools. Third, we show how our emulator can be used to mimic the I/O behavior of existing ransomware thereby enabling safe trace collection. Both the emulator and its application represent significant steps forward in ransomware detection in the era of machine-learning-driven cybersecurity.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
