Machine Learning to Ultimately Defeat Advanced Ransomware Threats
summary
Describes using machine learning plus call-stack analysis to detect and block advanced ransomware that performs arbitrary user or system process injection, with concrete coverage of how families such as Ryuk operate and how these techniques can deflect them.
AI-written summary · about
chapters (13)
- 0:00Start
- 1:38Ransomware as the typical example of zero day attacks
- 4:20Ryuk as the most advanced form of ransomware payloads (1)
- 8:27Ransomware Shell code injection with CreateRemoteThread
- 9:31Ransomware shell code injection with APC
- 10:26Ransomware DLL injection with SetWindowsHookEx
- 12:37Fighting Advanced Ransomware: Main Steps
- 14:23System diagram -training mode (malicious or good scenario)
- 15:49System diagram - production mode
- 24:09ML model training pipeline
- 25:57Learning Infrastructure
- 27:35Analysis of injections: Models comparison
- 29:51DEMO
related talks
40mRansomware Threat Landscape
33mLiving with Ransomware - The New Normal in Cyber Security
54mVirtual Session: How to Perform Ransomware Analysis
29mPrevention as a Business Strategy
37mRansomware Resilience: Holistic Defense for SOC Leaders
15mRansom Access Memories: Achieving Practical Ransomware Protection in Cloud with DeftPunk
52mRansomware 101: Get Smart Understanding Real Attacks
30mData Driven Security