RANSOMWARE MONITORING WITH ENHANCED BERKELEY PACKET FILTER (EBPF) AND MACHINE LEARNING. - Zhuravchak, Daniel (Science-based technologies, 2024)
This paper explores the relevance of protecting information systems from ransomware in the context of the rapid development of cybercrime, especially in the context of the war in Ukraine. The article focuses on the shortcomings of traditional anti-virus solutions and the need to introduce new technological solutions for effective monitoring of network traffic. One of the proposed solutions is the use of an enhanced Berkeley Packet Filter (eBPF), which allows detecting potentially malicious activity without interfering with the operating system kernel. The importance of solving this problem cannot be overestimated, given the severe consequences of ransomware attacks, which can range from the loss of important data to complete paralysis of the enterprise infrastructure. It is also noted that the eBPF can play an important role in developing mechanisms for detecting, analyzing and countering cyber threats, which is significant for both theoretical research and practical application in the field of cybersecurity. The rest of the article reveals the issues of using eBPF to monitor the activities of ransomware and detect it in network traffic. A comprehensive approach to evaluating machine learning algorithms that can be used to analyze data collected by eBPF is proposed, with an emphasis on the support vector machine (SVM) algorithm as the most suitable for detecting ransomware. The paper also evaluates the effectiveness of SVM in comparison to other tools, which emphasizes its advantages for cybersecurity tasks. The article concludes with a discussion of the possibilities of implementing eBPF in the practical field of cybersecurity, in particular, its impact on improving the efficiency of security systems, reducing incident response times, and ensuring more dynamic and flexible security management. The authors emphasize that solving this problem is of significant importance for the scientific community and practical application, suggesting new directions for further research in the field of cybersecurity