标题： 一种用于勒索软件分析和检测的Sysmon增量学习系统 显示英文标题

标题： A Sysmon Incremental Learning System for Ransomware Analysis and Detection

摘要： 面对日益增加的网络威胁，尤其是勒索软件攻击，迫切需要能够适应不断演变的恶意软件行为的先进检测和分析系统。 在文献中，使用机器学习（ML）来防止勒索软件攻击的方法越来越受欢迎。 不幸的是，大多数这些方案都采用了非增量学习方法，这些方法需要从头开始更新底层模型以检测新的勒索软件，浪费时间和资源。 这种方法存在问题，因为在重新训练期间，敏感数据可能容易受到攻击，因为新出现的勒索软件变种可能在模型更新前未被检测到。 此外，大多数这些方法并未设计用于实时数据流中的勒索软件检测，这限制了它们在复杂网络环境中的有效性。 为了解决这一挑战，我们提出了Sysmon增量学习系统用于勒索软件分析和检测（SILRAD），该系统能够对底层模型进行持续更新，并有效缩小训练差距。 通过利用Sysmon对系统活动进行详细监控的能力，我们的方法集成了在线增量学习技术，以提高勒索软件检测的适应性和效率。 最有效的检测特征是通过皮尔逊相关系数（PCC）选择的，并通过ADWIN算法实现概念漂移检测，确保模型能够对勒索软件行为的变化做出响应。 我们将结果与其他流行技术进行了比较，例如霍夫丁树（HT）和杠杆袋装分类器（LB），观察到检测准确率为98.89%，马修斯相关系数（MCC）速率为94.11%，证明了我们技术的有效性。 显示英文摘要

摘要： In the face of increasing cyber threats, particularly ransomware attacks, there is a pressing need for advanced detection and analysis systems that adapt to evolving malware behaviours. Throughout the literature, using machine learning (ML) to obviate ransomware attacks has increased in popularity. Unfortunately, most of these proposals leverage non-incremental learning approaches that require the underlying models to be updated from scratch to detect new ransomware, wasting time and resources. This approach is problematic because it leaves sensitive data vulnerable to attack during retraining, as newly emerging ransomware strains may go undetected until the model is updated. Furthermore, most of these approaches are not designed to detect ransomware in real-time data streams, limiting their effectiveness in complex network environments. To address this challenge, we present the Sysmon Incremental Learning System for Ransomware Analysis and Detection (SILRAD), which enables continuous updates to the underlying model and effectively closes the training gap. By leveraging the capabilities of Sysmon for detailed monitoring of system activities, our approach integrates online incremental learning techniques to enhance the adaptability and efficiency of ransomware detection. The most valuable features for detection were selected using the Pearson Correlation Coefficient (PCC), and concept drift detection was implemented through the ADWIN algorithm, ensuring that the model remains responsive to changes in ransomware behaviour. We compared our results to other popular techniques, such as Hoeffding Trees (HT) and Leveraging Bagging Classifier (LB), observing a detection accuracy of 98.89% and a Matthews Correlation Coefficient (MCC) rate of 94.11%, demonstrating the effectiveness of our technique.