Machine learning based vulnerable target identification in ransomware attack
A processor can be configured to receive data associated with, and/or access to, a computing system's file system structure. The processor can also be configured to determine file patterns, file path patterns and/or graph patterns associated with the computing system. The processor can also be configured to build a graph structure having nodes and edges, the graph structure representing the file patterns, file path patterns and graph patterns, wherein the nodes of the graph structure represent files and attributes of the files and the edges of the graph structure represent connectivity between the files. The processor can also be configured to train, based on the graph structure, a first machine learning model to learn a feature vector associated with a file. The processor can also be configured to train, based on the feature vector, a second machine learning model to identify a vulnerable ransomware target.
1. A computer-implemented method comprising:
receiving data associated with a computing system's file system structure;
determining file patterns, file path patterns and graph patterns associated with the computing system, which are susceptible to a ransomware attack, the graph patterns including at least search paths of infecting files in the computer system's file system structure and search strategies of infecting files along travel paths of directories of the computing system's file system structure, the search strategies specifying a graph traversal algorithm which is being used;
building a graph structure having nodes and edges, the graph structure representing the file patterns, the file path patterns and the graph patterns, wherein the nodes of the graph structure represent files and attributes of the files and the edges of the graph structure represent connectivity between the files;
training, based on the graph structure, a first machine learning model to learn a feature vector associated with a file, wherein the first machine learning model learns importance of the file patterns, the file path patterns and the graph patterns in the ransomware attack; and
training, based on the feature vector, a second machine learning model to identify a vulnerable ransomware target;
wherein the first machine learning model includes a graph convolutional network, the graph convolutional network transforming the attributes of the files and the connectivity between the files into a feature vector associated with each of the nodes in the graph structure, wherein the feature vector associated with each of the nodes in the graph structure is a k-dimensional representation of node features and structure features of the graph structure, wherein k is a hyperparameter of the graph convolutional network and is configurable, wherein k is user-defined;
deploy the second machine learning model for identifying a future ransomware target; and
trigger the computing system to perform a mitigating action based on the second machine learning model identifying the future ransomware target.
2. The method of claim 1 , wherein the mitigating action includes increasing security checks on the identified future ransomware target.
3. The method of claim 1 , wherein the second machine learning model includes a classifier.
4. The method of claim 1 , wherein the second machine learning model includes a binary classifier.
5. A system comprising:
a processor; and
a memory device coupled with the processor,
the processor configured to at least:
receive data associated with a computing system's file system structure;
determine file patterns, file path patterns and graph patterns associated with the computing system, which are susceptible to a ransomware attack, the graph patterns including at least search paths of infecting files in the computer system's file system structure and search strategies of infecting files along travel paths of directories of the computing system's file system structure, the search strategies specifying a graph traversal algorithm which is being used;
build a graph structure having nodes and edges, the graph structure representing the file patterns, the file path patterns and the graph patterns, wherein the nodes of the graph structure represent files and attributes of the files and the edges of the graph structure represent connectivity between the files;
train, based on the graph structure, a first machine learning model to learn a feature vector associated with a file, wherein the first machine learning model learns importance of the file patterns, the file path patterns and the graph patterns in the ransomware attack; and
train, based on the feature vector, a second machine learning model to identify a vulnerable ransomware target;
wherein the first machine learning model includes a graph convolutional network, the graph convolutional network transforming the attributes of the files and the connectivity between the files into a feature vector associated with each of the nodes in the graph structure, wherein the feature vector associated with each of the nodes in the graph structure is a k-dimensional representation of node features and structure features of the graph structure, wherein k is a hyperparameter of the graph convolutional network and is configurable, wherein k is user-defined;
deploy the second machine learning model for identifying a future ransomware target; and
trigger the computing system to perform a mitigating action based on the second machine learning model identifying the future ransomware target.
6. 5 , wherein the mitigating action includes increasing security checks on the identified future ransomware target.
7. The system of claim 5 , wherein the second machine learning model includes a classifier.
8. The system of claim 5 , wherein the second machine learning model includes a binary classifier.
9. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions readable by a device to cause the device to:
receive data associated with a computing system's file system structure;
determine file patterns, file path patterns and graph patterns associated with the computing system, which are susceptible to a ransomware attack, the graph patterns including at least search paths of infecting files in the computer system's file system structure and search strategies of infecting files along travel paths of directories of the computing system's file system structure, the search strategies specifying a graph traversal algorithm which is being used;
build a graph structure having nodes and edges, the graph structure representing the file patterns, the file path patterns and the graph patterns, wherein the nodes of the graph structure present files and attributes of the files and the edges of the graph structure represent connectivity between the files;
train, based on the graph structure, a first machine learning model to learn a feature vector associated with a file, wherein the first machine learning model learns importance of the file patterns, the file path patterns and the graph patterns in the ransomware attack; and
train, based on the feature vector, a second machine learning model to identify a vulnerable ransomware target;
wherein the first machine learning model includes a graph convolutional network, the graph convolutional network transforming the attributes of the files and the connectivity between the files into a feature vector associated with each of the nodes in the graph structure, wherein the feature vector associated with each of the nodes in the graph structure is a k-dimensional representation of node features and structure features of the graph structure, wherein k is a hyperparameter of the graph convolutional network and is configurable, wherein k is user-defined;
deploy the second machine learning model for identifying a future ransomware target; and
trigger the computing system to perform a mitigating action based on the second machine learning model identifying the future ransomware target.