揭示动态与模式：低标签勒索软件家族传播模式与相似性的综合分析
Unveiling Dynamics and Patterns: A Comprehensive Analysis of Spreading Patterns and Similarities in Low-Labelled Ransomware Families
AI总结：
本文通过分析低标签勒索软件家族在比特币网络中的地址-交易图，提出基于节点动态的地址行为分配方法，以识别支付传播模式并检测不同变种间的相似性，揭示其相似性主要来自赎金收集和洗钱行为。
摘要：
勒索软件已成为最普遍的威胁之一，主要原因是其易于部署，并且攻击者能够便捷地获取用于筹集和混淆资金的服务。随着加密货币的出现，这一资金环节得到了显著增强——加密货币促进了去中心化和匿名性，使该威胁演变为大规模爆发。然而，近期报告表明，一小群个体主导着勒索软件生态系统，并试图通过使用多个存活时间较短的变种来混淆其活动。这一情形提示，不同变种可能在赎金收集、资金转移和洗钱操作中共享机制。为此，本研究旨在分析低标签勒索软件家族在比特币网络中生成的地址-交易图。我们的目标是识别支付传播模式，以评估勒索软件家族的演化，并检测可能由同一攻击者控制的不同变种之间的相似性。具体而言，后一任务根据每个节点的动态，为地址-交易图中的每个节点赋予一种地址行为。每个变种中行为的分布最终被用于评估不同勒索软件家族之间的接近程度。我们的研究结果表明，尽管勒索软件家族能够迅速与数百万个地址建立连接，但许多家族仍需要多步分析。此外，研究证明所引入的行为能够有效用于突出不同勒索软件变种之间的相似性。结果显示，家族之间的相似性主要源于通常与赎金收集和洗钱操作相关的行为。
英文摘要：
Ransomware has become one of the most widespread threats, primarily due to its easy deployment and the accessibility to services that enable attackers to raise and obfuscate funds. This latter aspect has been significantly enhanced with the advent of cryptocurrencies, which, by fostering decentralisation and anonymity, have transformed this threat into a large-scale outbreak. However, recent reports indicate that a small group of individuals dominate the ransomware ecosystem and try to obfuscate their activity using multiple strains characterised by a short time to live. This scenario suggests that different strains could share mechanisms in ransom collection, fund movement, and money laundering operations. For this reason, this study aims to analyse the address-transaction graphs generated in the Bitcoin network by low-labelled ransomware families. Our goals are to identify payment spreading patterns for evaluating the evolution of ransomware families and to detect similarities among different strains that potentially can be controlled by the same attacker. Specifically, this latter task assigns an address behaviour to each node in the address-transaction graphs according to its dynamics. The distribution of the behaviours in each strain is finally used to evaluate the closeness among different ransomware families. Our findings show that although ransomware families can quickly establish connections with millions of addresses, numerous families require multiple-step analysis. Furthermore, the study demonstrates that the introduced behaviours can effectively be used to highlight similarities among different ransomware strains. The outcome shows that families are similar primarily due to behaviours usually associated with ransom collection and money laundering operations.+
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
