A Linguistic Analysis Metric in Detecting Ransomware Cyber-attacks

Originating and striking from anywhere, cyber-attacks have become ever more sophisticated in our modern society and users are forced to adopt increasingly good and vigilant practices to protect from them. Among these, ransomware remains a major cyber-attack whose major threat to end users (disrupted operations, restricted files, scrambled sensitive data, financial demands, etc.) does not particularly lie in number but in severity. In this study we explore the possibility of real-time detection of ransomware source through a linguistic analysis that examines machine translation relative to the Levenshtein Distance and may thereby provide important indications as to attacker’s language of origin. Specifically, the aim of our research is to advance a metric to assist in determining whether an external ransom text is an indicator of either a human- or a machine-generated cyber-attack. Our proposed method works its argument on a set of Eastern European languages but is applicable to a large(r) range of languages and/or probabilistic patterns, being characterized by usage of limited resources and scalability properties.

@article{Florea2021,
  title     = {A Linguistic Analysis Metric in Detecting Ransomware Cyber-attacks},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {12},
  number    = {11},
  year      = {2021},
  publisher = {The Science and Information Organization},
  author    = {Diana Florea and Wayne Patterson},
  doi       = {10.14569/IJACSA.2021.0121158},
  url       = {https://doi.org/10.14569/IJACSA.2021.0121158}
}