RANSOMWARE SPREAD PREVENTION SYSTEM USING PYTHON, AUDITD AND LINUX

Abstract

The data-driven period produces more and more security-related challenges that even experts can hardly deal with. One of the most complex threats is ransomware, which is very taxing and devastating to detect and mainly prevent. The success of correlation lies in the variety of data sources. During the study of the methods of action of ransomware viruses, it was found that the main purpose is to demand ransom for decryption of data that were on the file system and during the penetration of the system, the ransomware virus successfully encrypted. The first global attack of the ransowmare (NotPetya) on the territory of Ukraine was on June 27, 2017. According to the Administration of US President Donald Trump, the attack using the NotPetya virus in June 2017 became the largest hacker attack in history. In a joint statement, the Five Eyes claimed responsibility for the attack on Russian authorities. The governments of Denmark and Ukraine are also blaming Russia for the attack. Many analysts have called these actions not just political in nature, but military aggression. A honeypot trap method was found while researching methods for detecting and counteracting ransomware. It was planned to develop a honeypot system on its own based on the Linux file system. Our research methods showed significant results in identifying ransomware processes using the honeypot concept augmented with symbolic linking to reduce damage made to the file system. The CIA (confidentiality, integrity, availability) metrics have been adhered to. We propose to optimize the malware process termination procedure and introduce an artificial intelligence-human collaboration to enhance ransomware classification and detection.