Yau, Ti Dun and Mohd Faizal, Ab Razak and Mohamad Fadli, Zolkipli and Tan Fui, Fui Bee and Ahmad Firdaus, Zainal Abidin (2022) Hermes ransomware v2.1 action monitoring using next generation security operation center (NGSOC) complex correlation rules. International Journal on Advanced Science, Engineering and Information Technology, 12 (3). pp. 1287-1292. ISSN 2088-5334. (Published)
|
Pdf
Hermes ransomware v2.1 action monitoring.pdf Available under License Creative Commons Attribution Share Alike. Download (1MB) | Preview |
Abstract
A new malware is identified every fewer than five seconds in today's threat environment, which is changing at a rapid speed. As part of cybercrime, there is a lot of malware activity that can infect the system and make it problematic. Cybercrime is a rapidly growing field, allowing cyber thieves to engage in a wide range of damaging activities. Hacking, scams, child pornography, and identity theft are all examples of cybercrime. Cybercrime victims might be single entities or groups of persons who are being targeted for harm. Cybercrime and malware become more hazardous and damaging because of these factors. Subsequent to these factors, there is a need to construct Next Generation Security Operation Centers (NGSOCs). SOC consists of human resources, processes, and technology designed to deal with security events derived from the Security Incident Event Management (SIEM) log analysis. This research examines how Next Generation Security Operation Centers (NGSOCs) respond to malicious activity. This study develops a use case to detect the latest Hermes Ransomware v2.1 malware using complex correlation rules for the SIEM anomalies engine. This study aims to analyze and detect Hermes Ransomware v2.1. As a result, NGSOC distinguishes malware activities' initial stages by halting traffic attempts to download malware. By forwarding logs to SIEM, the use case can support Threat Analyst in finding other Indicators of Compromise (IOC) to assist organizations in developing a systematic and more preemptive approach for ransomware detection.
| Item Type: | Article |
|---|---|
| Uncontrolled Keywords: | SIEM; NGSOC; Ransomware; Correlation rule; Malware |
| Subjects: | Q Science > QA Mathematics > QA76 Computer software |
| Faculty/Division: | Institute of Postgraduate Studies Faculty of Computing |
| Depositing User: | Mrs Norsaini Abdul Samat |
| Date Deposited: | 21 Jul 2022 07:58 |
| Last Modified: | 21 Jul 2022 07:58 |
| URI: | http://umpir.ump.edu.my/id/eprint/34758 |
| Download Statistic: | View Download Statistics |
Actions (login required)
 |
View Item |