{"id":7170,"date":"2023-07-27T16:00:22","date_gmt":"2023-07-27T09:00:22","guid":{"rendered":"https:\/\/vacif.com\/?p=7170"},"modified":"2023-07-27T16:00:22","modified_gmt":"2023-07-27T09:00:22","slug":"tong-quan-ve-cac-cong-nghe-duoc-su-dung-de-phat-hien-ransomware","status":"publish","type":"post","link":"https:\/\/vacif.com\/en\/tong-quan-ve-cac-cong-nghe-duoc-su-dung-de-phat-hien-ransomware\/","title":{"rendered":"T\u1ed4NG QUAN V\u1ec0 C\u00c1C C\u00d4NG NGH\u1ec6 \u0110\u01af\u1ee2C S\u1eec D\u1ee4NG \u0110\u1ec2 PH\u00c1T HI\u1ec6N RANSOMWARE."},"content":{"rendered":"\n

C\u00f4ng ngh\u1ec7 ph\u00e1t hi\u1ec7n ransomware l\u00e0 m\u1ed9t t\u1eadp h\u1ee3p c\u00e1c k\u1ef9 thu\u1eadt v\u00e0 c\u01a1 ch\u1ebf \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 x\u00e1c \u0111\u1ecbnh v\u00e0 nh\u1eadn bi\u1ebft s\u1ef1 hi\u1ec7n di\u1ec7n c\u1ee7a ransomware trong h\u1ec7 th\u1ed1ng ho\u1eb7c thi\u1ebft b\u1ecb. M\u1ee5c ti\u00eau c\u1ee7a c\u00f4ng ngh\u1ec7 n\u00e0y l\u00e0 ph\u00e1t hi\u1ec7n v\u00e0 ng\u0103n ch\u1eb7n ransomware tr\u01b0\u1edbc khi n\u00f3 c\u00f3 th\u1ec3 g\u00e2y h\u1ea1i v\u00e0 m\u00e3 h\u00f3a d\u1eef li\u1ec7u c\u1ee7a ng\u01b0\u1eddi d\u00f9ng.<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

1. L\u1ecbch s\u1eed ph\u00e1t tri\u1ec3n c\u1ee7a Ransomware.<\/strong><\/p>\n\n\n\n

Th\u1eadp k\u1ef7 1990: <\/strong>Ransomware \u0111\u1ea7u ti\u00ean xu\u1ea5t hi\u1ec7n v\u00e0o nh\u1eefng n\u0103m 1990 v\u1edbi lo\u1ea1i ransomware c\u00f3 t\u00ean l\u00e0 AIDS (c\u0169ng \u0111\u01b0\u1ee3c g\u1ecdi l\u00e0 PC Cyborg). Ransomware n\u00e0y \u0111\u00e3 m\u00e3 h\u00f3a c\u00e1c t\u1ec7p trong h\u1ec7 th\u1ed1ng c\u1ee7a n\u1ea1n nh\u00e2n v\u00e0 y\u00eau c\u1ea7u h\u1ecd g\u1eedi ti\u1ec1n qua th\u01b0 b\u01b0u \u0111i\u1ec7n \u0111\u1ec3 nh\u1eadn \u0111\u01b0\u1ee3c kh\u00f3a gi\u1ea3i m\u00e3. Tuy nhi\u00ean, vi\u1ec7c tr\u1ea3 ti\u1ec1n kh\u00f4ng \u0111\u1ea3m b\u1ea3o n\u1ea1n nh\u00e2n s\u1ebd nh\u1eadn \u0111\u01b0\u1ee3c kh\u00f3a gi\u1ea3i m\u00e3.<\/p>\n\n\n\n

N\u0103m 2005:<\/strong> Ransomware \u0111\u00e3 ti\u1ebfn h\u00e0nh m\u00e3 h\u00f3a th\u00f4ng tin c\u00e1 nh\u00e2n c\u1ee7a ng\u01b0\u1eddi d\u00f9ng v\u00e0 \u0111\u00f2i ti\u1ec1n chu\u1ed9c th\u00f4ng qua c\u00e1c d\u1ecbch v\u1ee5 tr\u1ef1c tuy\u1ebfn nh\u01b0 Western Union ho\u1eb7c PayPal. M\u1ed9t v\u00ed d\u1ee5 n\u1ed5i ti\u1ebfng l\u00e0 Gpcode ransomware.<\/p>\n\n\n\n

N\u0103m 2010: <\/strong>S\u1ef1 gia t\u0103ng \u0111\u00e1ng k\u1ec3 v\u1ec1 s\u1ed1 l\u01b0\u1ee3ng v\u00e0 s\u1ef1 ph\u1ee9c t\u1ea1p c\u1ee7a c\u00e1c m\u1eabu ransomware \u0111\u00e3 \u0111\u01b0\u1ee3c ghi nh\u1eadn v\u00e0o nh\u1eefng n\u0103m n\u00e0y. M\u1ed9t s\u1ed1 lo\u1ea1i ransomware \u0111\u00e3 b\u1eaft \u0111\u1ea7u s\u1eed d\u1ee5ng m\u00e3 h\u00f3a ch\u00eca kh\u00f3a c\u00f4ng khai \u0111\u1ec3 l\u00e0m cho vi\u1ec7c gi\u1ea3i m\u00e3 tr\u1edf n\u00ean kh\u00f3 kh\u0103n h\u01a1n. Trong n\u0103m 2010, lo\u1ea1i ransomware WinLock xu\u1ea5t hi\u1ec7n, kh\u00f3a m\u00e1y t\u00ednh c\u1ee7a n\u1ea1n nh\u00e2n v\u00e0 y\u00eau c\u1ea7u h\u1ecd tr\u1ea3 ti\u1ec1n \u0111\u1ec3 m\u1edf kh\u00f3a.<\/p>\n\n\n\n

N\u0103m 2013:<\/strong> Ransomware CryptoLocker xu\u1ea5t hi\u1ec7n v\u00e0 nhanh ch\u00f3ng tr\u1edf n\u00ean r\u1ea5t ph\u1ed5 bi\u1ebfn. CryptoLocker \u0111\u00e3 s\u1eed d\u1ee5ng m\u00e3 h\u00f3a ch\u00eca kh\u00f3a c\u00f4ng khai v\u00e0 y\u00eau c\u1ea7u n\u1ea1n nh\u00e2n tr\u1ea3 ti\u1ec1n chu\u1ed9c b\u1eb1ng Bitcoin. Ransomware n\u00e0y \u0111\u00e3 g\u00e2y ra thi\u1ec7t h\u1ea1i nghi\u00eam tr\u1ecdng v\u00e0 thu l\u1eddi h\u00e0ng tri\u1ec7u \u0111\u00f4 la t\u1eeb c\u00e1c n\u1ea1n nh\u00e2n. M\u1eb7c d\u00f9 c\u01a1 quan ch\u1ee9c n\u0103ng \u0111\u00e3 ti\u00eau di\u1ec7t CryptoLocker, n\u00f3 \u0111\u00e3 m\u1edf \u0111\u01b0\u1eddng cho nh\u1eefng bi\u1ebfn th\u1ec3 ransomware kh\u00e1c.<\/p>\n\n\n\n

N\u0103m 2016:<\/strong> S\u1ef1 gia t\u0103ng \u0111\u00e1ng k\u1ec3 v\u1ec1 s\u1ed1 l\u01b0\u1ee3ng c\u00e1c lo\u1ea1i ransomware m\u1edbi \u0111\u00e3 \u0111\u01b0\u1ee3c ghi nh\u1eadn trong n\u0103m 2016. Ransomware WannaCry \u0111\u00e3 xu\u1ea5t hi\u1ec7n v\u00e0 t\u1ea5n c\u00f4ng h\u00e0ng lo\u1ea1t h\u1ec7 th\u1ed1ng to\u00e0n c\u1ea7u th\u00f4ng qua c\u00e1c l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt trong h\u1ec7 \u0111i\u1ec1u h\u00e0nh Windows. N\u00f3 \u0111\u00e3 y\u00eau c\u1ea7u c\u00e1c n\u1ea1n nh\u00e2n tr\u1ea3 ti\u1ec1n chu\u1ed9c b\u1eb1ng Bitcoin \u0111\u1ec3 gi\u1ea3i m\u00e3 d\u1eef li\u1ec7u c\u1ee7a h\u1ecd. WannaCry g\u00e2y ra h\u1eadu qu\u1ea3 nghi\u00eam tr\u1ecdng v\u00e0 thu \u0111\u01b0\u1ee3c h\u00e0ng tr\u0103m tri\u1ec7u \u0111\u00f4 la t\u1eeb c\u00e1c n\u1ea1n nh\u00e2n.<\/p>\n\n\n\n

N\u0103m 2020: <\/strong>Ransomware ti\u1ebfp t\u1ee5c ph\u00e1t tri\u1ec3n v\u00e0 \u0111a d\u1ea1ng h\u00f3a. Xu\u1ea5t hi\u1ec7n c\u00e1c bi\u1ebfn th\u1ec3 ransomware m\u1edbi nh\u01b0 Ryuk, Maze, Sodinokibi, v\u00e0 Conti v\u1edbi c\u00e1c k\u1ef9 thu\u1eadt ph\u00e1t t\u00e1n, m\u00e3 h\u00f3a v\u00e0 y\u00eau c\u1ea7u ti\u1ec1n chu\u1ed9c ng\u00e0y c\u00e0ng tinh vi h\u01a1n. Ransomware c\u0169ng b\u1eaft \u0111\u1ea7u s\u1eed d\u1ee5ng c\u00e1c ph\u01b0\u01a1ng th\u1ee9c trao \u0111\u1ed5i kh\u00f3a b\u00ed m\u1eadt (ECDH) \u0111\u1ec3 m\u00e3 h\u00f3a kh\u00f3a gi\u1ea3i m\u00e3, l\u00e0m cho vi\u1ec7c gi\u1ea3i m\u00e3 tr\u1edf n\u00ean kh\u00f3 kh\u0103n h\u01a1n.<\/p>\n\n\n\n

Hi\u1ec7n t\u1ea1i:<\/strong> Ransomware ti\u1ebfp t\u1ee5c l\u00e0 m\u1ed9t trong nh\u1eefng m\u1ed1i \u0111e d\u1ecda nghi\u00eam tr\u1ecdng nh\u1ea5t \u0111\u1ed1i v\u1edbi c\u00e1 nh\u00e2n v\u00e0 doanh nghi\u1ec7p tr\u00ean to\u00e0n th\u1ebf gi\u1edbi. C\u00e1c hacker li\u00ean t\u1ee5c c\u1ea3i ti\u1ebfn ransomware c\u1ee7a h\u1ecd v\u00e0 t\u00ecm ki\u1ebfm c\u00e1c c\u00e1ch m\u1edbi \u0111\u1ec3 l\u00e2y nhi\u1ec5m v\u00e0 t\u1ea5n c\u00f4ng n\u1ea1n nh\u00e2n. C\u00e1c ph\u1ea7n m\u1ec1m ch\u1ed1ng ransomware c\u0169ng ti\u1ebfp t\u1ee5c \u0111\u01b0\u1ee3c c\u1eadp nh\u1eadt v\u00e0 c\u1ea3i ti\u1ebfn \u0111\u1ec3 \u0111\u1ed1i ph\u00f3 v\u1edbi nh\u1eefng m\u1ed1i \u0111e d\u1ecda m\u1edbi v\u00e0 ti\u1ebfn h\u00f3a c\u1ee7a ransomware.<\/p>\n\n\n\n

2. T\u1ed5ng quan c\u00e1c c\u00f4ng ngh\u1ec7 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 ph\u00e1t hi\u1ec7n Ransomware.<\/strong><\/p>\n\n\n\n

L\u1ecbch s\u1eed ph\u00e1t tri\u1ec3n c\u1ee7a c\u00e1c c\u00f4ng ngh\u1ec7 ph\u00e1t hi\u1ec7n ransomware l\u00e0 m\u1ed9t qu\u00e1 tr\u00ecnh li\u00ean t\u1ee5c c\u1ee7a s\u1ef1 ti\u1ebfn b\u1ed9 v\u00e0 c\u1ea3i ti\u1ebfn \u0111\u1ec3 \u0111\u1ed1i ph\u00f3 v\u1edbi s\u1ef1 ph\u00e1t tri\u1ec3n ng\u00e0y c\u00e0ng ph\u1ee9c t\u1ea1p v\u00e0 tinh vi c\u1ee7a ransomware.<\/p>\n\n\n\n

2.1 Ch\u1eef k\u00fd v\u00e0 Hash (Signature and Hash-Based Detection).<\/strong><\/p>\n\n\n\n

C\u00e1ch ho\u1ea1t \u0111\u1ed9ng:<\/strong> C\u00e1c c\u00f4ng ngh\u1ec7 n\u00e0y s\u1eed d\u1ee5ng c\u00e1c ch\u1eef k\u00fd ho\u1eb7c m\u00e3 hash c\u1ee7a c\u00e1c bi\u1ebfn th\u1ec3 ransomware \u0111\u00e3 bi\u1ebft \u0111\u1ec3 so kh\u1edbp v\u00e0 nh\u1eadn di\u1ec7n c\u00e1c t\u1ec7p ho\u1eb7c quy tr\u00ecnh b\u1ecb nhi\u1ec5m. C\u00e1c ch\u1eef k\u00fd ho\u1eb7c hash \u0111\u01b0\u1ee3c l\u01b0u tr\u1eef trong c\u01a1 s\u1edf d\u1eef li\u1ec7u c\u1ee7a gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt v\u00e0 \u0111\u01b0\u1ee3c so s\u00e1nh v\u1edbi c\u00e1c t\u1ec7p v\u00e0 quy tr\u00ecnh tr\u00ean h\u1ec7 th\u1ed1ng \u0111\u1ec3 x\u00e1c \u0111\u1ecbnh xem c\u00f3 b\u1ea5t k\u1ef3 s\u1ef1 kh\u1edbp n\u00e0o hay kh\u00f4ng.<\/p>\n\n\n\n

\u01afu \u0111i\u1ec3m:<\/strong> Hi\u1ec7u qu\u1ea3 v\u00e0 nhanh ch\u00f3ng \u0111\u1ed1i v\u1edbi c\u00e1c bi\u1ebfn th\u1ec3 ransomware \u0111\u00e3 bi\u1ebft.<\/p>\n\n\n\n

H\u1ea1n ch\u1ebf: <\/strong>Kh\u00f4ng hi\u1ec7u qu\u1ea3 \u0111\u1ed1i v\u1edbi ransomware m\u1edbi v\u00e0 ch\u01b0a bi\u1ebft, v\u00ec ch\u01b0a c\u00f3 ch\u1eef k\u00fd ho\u1eb7c hash cho c\u00e1c bi\u1ebfn th\u1ec3 n\u00e0y trong c\u01a1 s\u1edf d\u1eef li\u1ec7u.<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

V\u00ed d\u1ee5:<\/strong> M\u1ed9t c\u00f4ng ty tri\u1ec3n khai m\u1ed9t ph\u1ea7n m\u1ec1m b\u1ea3o m\u1eadt tr\u00ean m\u00e1y t\u00ednh v\u00e0 m\u00e1y ch\u1ee7 trong m\u1ea1ng n\u1ed9i b\u1ed9 c\u1ee7a h\u1ecd. Ph\u1ea7n m\u1ec1m n\u00e0y c\u00f3 t\u00edch h\u1ee3p t\u00ednh n\u0103ng ph\u00e1t hi\u1ec7n ransomware d\u1ef1a tr\u00ean Signature and Hash-Based Detection.<\/strong><\/p>\n\n\n\n

    \n
  • X\u00e2y d\u1ef1ng c\u01a1 s\u1edf d\u1eef li\u1ec7u ch\u1eef k\u00fd v\u00e0 hash: <\/strong>Tr\u01b0\u1edbc khi tri\u1ec3n khai, nh\u00e0 cung c\u1ea5p ph\u1ea7n m\u1ec1m b\u1ea3o m\u1eadt s\u1ebd x\u00e2y d\u1ef1ng c\u01a1 s\u1edf d\u1eef li\u1ec7u ch\u1eef k\u00fd v\u00e0 hash c\u1ee7a c\u00e1c bi\u1ebfn th\u1ec3 ransomware \u0111\u00e3 bi\u1ebft. C\u01a1 s\u1edf d\u1eef li\u1ec7u n\u00e0y bao g\u1ed3m c\u00e1c ch\u1eef k\u00fd v\u00e0 m\u00e3 hash c\u1ee7a c\u00e1c t\u1ec7p v\u00e0 quy tr\u00ecnh ransomware \u0111\u00e3 bi\u1ebft t\u1eeb qu\u00e1 kh\u1ee9.<\/li>\n\n\n\n
  • C\u1eadp nh\u1eadt c\u01a1 s\u1edf d\u1eef li\u1ec7u \u0111\u1ecbnh k\u1ef3:<\/strong> Nh\u00e0 cung c\u1ea5p s\u1ebd c\u1eadp nh\u1eadt c\u01a1 s\u1edf d\u1eef li\u1ec7u ch\u1eef k\u00fd v\u00e0 hash \u0111\u1ecbnh k\u1ef3 \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o r\u1eb1ng n\u00f3 lu\u00f4n ch\u1ee9a th\u00f4ng tin v\u1ec1 c\u00e1c bi\u1ebfn th\u1ec3 ransomware m\u1edbi v\u00e0 ph\u1ed5 bi\u1ebfn nh\u1ea5t.<\/li>\n\n\n\n
  • Ki\u1ec3m tra t\u1ec7p m\u1edbi:<\/strong> Khi m\u1ed9t t\u1ec7p m\u1edbi \u0111\u01b0\u1ee3c t\u1ea3i xu\u1ed1ng ho\u1eb7c t\u1ea1o ra tr\u00ean m\u00e1y t\u00ednh ho\u1eb7c m\u00e1y ch\u1ee7, ph\u1ea7n m\u1ec1m b\u1ea3o m\u1eadt s\u1ebd ti\u1ebfn h\u00e0nh ki\u1ec3m tra ch\u1eef k\u00fd v\u00e0 m\u00e3 hash c\u1ee7a t\u1ec7p n\u00e0y v\u1edbi c\u01a1 s\u1edf d\u1eef li\u1ec7u ch\u1eef k\u00fd v\u00e0 hash \u0111\u00e3 x\u00e2y d\u1ef1ng. N\u1ebfu t\u1ec7p n\u00e0y c\u00f3 ch\u1eef k\u00fd ho\u1eb7c m\u00e3 hash kh\u1edbp v\u1edbi m\u1ed9t bi\u1ebfn th\u1ec3 ransomware \u0111\u00e3 bi\u1ebft, ph\u1ea7n m\u1ec1m s\u1ebd x\u00e1c \u0111\u1ecbnh n\u00f3 l\u00e0 \u0111\u00e1ng ng\u1edd.<\/li>\n\n\n\n
  • C\u1ea3nh b\u00e1o v\u00e0 h\u00e0nh \u0111\u1ed9ng: <\/strong>Khi ph\u1ea7n m\u1ec1m ph\u00e1t hi\u1ec7n m\u1ed9t t\u1ec7p c\u00f3 ch\u1eef k\u00fd ho\u1eb7c hash kh\u1edbp v\u1edbi ransomware \u0111\u00e3 bi\u1ebft, n\u00f3 s\u1ebd c\u1ea3nh b\u00e1o ng\u01b0\u1eddi qu\u1ea3n tr\u1ecb h\u1ec7 th\u1ed1ng ho\u1eb7c th\u1ef1c hi\u1ec7n c\u00e1c bi\u1ec7n ph\u00e1p ng\u0103n ch\u1eb7n nh\u01b0 c\u00e1ch ly t\u1ec7p, x\u00f3a n\u00f3 ho\u1eb7c c\u1ea3nh b\u00e1o ng\u01b0\u1eddi d\u00f9ng v\u1ec1 nguy c\u01a1.<\/li>\n\n\n\n
  • T\u00ecnh hu\u1ed1ng th\u1ef1c t\u1ebf: <\/strong>M\u1ed9t nh\u00e2n vi\u00ean c\u1ee7a c\u00f4ng ty t\u1ea3i xu\u1ed1ng m\u1ed9t t\u1ec7p t\u1eeb m\u1ed9t email \u0111\u00e1ng ng\u1edd. Khi t\u1ec7p n\u00e0y \u0111\u01b0\u1ee3c l\u01b0u tr\u1eef tr\u00ean m\u00e1y t\u00ednh c\u00e1 nh\u00e2n, ph\u1ea7n m\u1ec1m b\u1ea3o m\u1eadt s\u1ebd t\u1ef1 \u0111\u1ed9ng qu\u00e9t v\u00e0 so s\u00e1nh ch\u1eef k\u00fd v\u00e0 hash c\u1ee7a t\u1ec7p n\u00e0y v\u1edbi c\u01a1 s\u1edf d\u1eef li\u1ec7u ch\u1eef k\u00fd v\u00e0 hash ransomware. N\u1ebfu t\u1ec7p n\u00e0y tr\u00f9ng kh\u1edbp v\u1edbi m\u1ed9t bi\u1ebfn th\u1ec3 ransomware \u0111\u00e3 bi\u1ebft, ph\u1ea7n m\u1ec1m s\u1ebd c\u1ea3nh b\u00e1o ng\u01b0\u1eddi d\u00f9ng v\u00e0 y\u00eau c\u1ea7u x\u00f3a t\u1ec7p \u0111\u1ec3 ng\u0103n ch\u1eb7n nhi\u1ec5m ransomware v\u00e0o h\u1ec7 th\u1ed1ng.<\/li>\n<\/ul>\n\n\n\n

    2.2 Heuristics (Behavioral Detection).<\/strong><\/p>\n\n\n\n

    C\u00e1ch ho\u1ea1t \u0111\u1ed9ng: <\/strong>C\u00e1c k\u1ef9 thu\u1eadt heuristics \u0111\u00e1nh gi\u00e1 c\u00e1c t\u00ednh n\u0103ng \u0111\u1eb7c tr\u01b0ng c\u1ee7a ransomware, ch\u1eb3ng h\u1ea1n nh\u01b0 c\u00e1ch m\u00e3 h\u00f3a d\u1eef li\u1ec7u, ho\u1ea1t \u0111\u1ed9ng m\u1ea1ng b\u1ea5t th\u01b0\u1eddng ho\u1eb7c c\u00e1c t\u00e1c v\u1ee5 \u0111\u00e1ng ng\u1edd kh\u00e1c. N\u00f3 ph\u00e2n t\u00edch c\u00e1c h\u00e0nh vi c\u1ee7a c\u00e1c t\u1ec7p v\u00e0 quy tr\u00ecnh tr\u00ean h\u1ec7 th\u1ed1ng \u0111\u1ec3 x\u00e1c \u0111\u1ecbnh c\u00e1c ho\u1ea1t \u0111\u1ed9ng kh\u00f4ng b\u00ecnh th\u01b0\u1eddng v\u00e0 nghi ng\u1edd.<\/p>\n\n\n\n

    \u01afu \u0111i\u1ec3m:<\/strong> Ph\u00e1t hi\u1ec7n c\u00e1c bi\u1ebfn th\u1ec3 ransomware m\u1edbi v\u00e0 ch\u01b0a bi\u1ebft d\u1ef1a tr\u00ean h\u00e0nh vi \u0111\u00e1ng ng\u1edd.<\/p>\n\n\n\n

    H\u1ea1n ch\u1ebf:<\/strong> C\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn vi\u1ec7c x\u00e1c \u0111\u1ecbnh sai (false positive) khi m\u1ed9t ph\u1ea7n m\u1ec1m h\u1ee3p ph\u00e1p th\u1ef1c hi\u1ec7n c\u00e1c h\u00e0nh vi t\u01b0\u01a1ng t\u1ef1 nh\u01b0 ransomware.<\/p>\n\n\n

    \n
    \"\"<\/figure>\n<\/div>\n\n\n

    V\u00ed d\u1ee5: <\/strong>M\u1ed9t doanh nghi\u1ec7p tri\u1ec3n khai m\u1ed9t gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt m\u1ea1ng c\u00f3 t\u00edch h\u1ee3p ch\u1ee9c n\u0103ng ph\u00e1t hi\u1ec7n ransomware d\u1ef1a tr\u00ean Behavioral Detection.<\/strong><\/p>\n\n\n\n

      \n
    • X\u00e2y d\u1ef1ng c\u01a1 s\u1edf d\u1eef li\u1ec7u h\u00e0nh vi ransomware: <\/strong>Tr\u01b0\u1edbc khi tri\u1ec3n khai, gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt s\u1ebd x\u00e2y d\u1ef1ng c\u01a1 s\u1edf d\u1eef li\u1ec7u ch\u1ee9a c\u00e1c h\u00e0nh vi \u0111\u00e1ng ng\u1edd c\u1ee7a ransomware \u0111\u00e3 bi\u1ebft. C\u01a1 s\u1edf d\u1eef li\u1ec7u n\u00e0y bao g\u1ed3m c\u00e1c h\u00e0nh vi nh\u01b0 m\u00e3 h\u00f3a t\u1ec7p, t\u1ea1o ra c\u00e1c quy tr\u00ecnh \u0111\u00e1ng ng\u1edd, thay \u0111\u1ed5i quy\u1ec1n truy c\u1eadp v\u00e0o t\u1ec7p, v\u00e0 t\u1ea1o k\u1ebft n\u1ed1i m\u1ea1ng kh\u00f4ng b\u00ecnh th\u01b0\u1eddng.<\/li>\n\n\n\n
    • Ph\u00e2n t\u00edch h\u00e0nh vi m\u1edbi:<\/strong> Khi m\u1ed9t quy tr\u00ecnh ho\u1eb7c t\u1ec7p m\u1edbi \u0111\u01b0\u1ee3c th\u1ef1c thi tr\u00ean m\u1ea1ng, gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt s\u1ebd ph\u00e2n t\u00edch h\u00e0nh vi c\u1ee7a n\u00f3. N\u00f3 s\u1ebd quan s\u00e1t c\u00e1c ho\u1ea1t \u0111\u1ed9ng nh\u01b0 c\u00e1c y\u00eau c\u1ea7u m\u1ea1ng \u0111\u00e1ng ng\u1edd, s\u1ef1 thay \u0111\u1ed5i l\u1edbn \u0111\u1ebfn c\u00e1c t\u1ec7p quan tr\u1ecdng, ho\u1eb7c vi\u1ec7c th\u1ef1c hi\u1ec7n m\u00e3 h\u00f3a tr\u00ean nhi\u1ec1u t\u1ec7p trong th\u1eddi gian ng\u1eafn.<\/li>\n\n\n\n
    • So s\u00e1nh v\u1edbi c\u01a1 s\u1edf d\u1eef li\u1ec7u h\u00e0nh vi ransomware \u0111\u00e3 bi\u1ebft:<\/strong> Gi\u1ea3i ph\u00e1p s\u1ebd so s\u00e1nh h\u00e0nh vi c\u1ee7a quy tr\u00ecnh ho\u1eb7c t\u1ec7p m\u1edbi v\u1edbi c\u00e1c h\u00e0nh vi \u0111\u00e3 bi\u1ebft trong c\u01a1 s\u1edf d\u1eef li\u1ec7u. N\u1ebfu t\u00ecm th\u1ea5y c\u00e1c h\u00e0nh vi \u0111\u00e1ng ng\u1edd ho\u1eb7c tr\u00f9ng kh\u1edbp v\u1edbi ransomware \u0111\u00e3 bi\u1ebft, gi\u1ea3i ph\u00e1p s\u1ebd x\u00e1c \u0111\u1ecbnh n\u00f3 l\u00e0 \u0111\u00e1ng ng\u1edd.<\/li>\n\n\n\n
    • C\u1ea3nh b\u00e1o v\u00e0 bi\u1ec7n ph\u00e1p ng\u0103n ch\u1eb7n: <\/strong>Khi gi\u1ea3i ph\u00e1p ph\u00e1t hi\u1ec7n m\u1ed9t h\u00e0nh vi ransomware \u0111\u00e1ng ng\u1edd, n\u00f3 s\u1ebd c\u1ea3nh b\u00e1o ng\u01b0\u1eddi qu\u1ea3n tr\u1ecb h\u1ec7 th\u1ed1ng v\u00e0 th\u1ef1c hi\u1ec7n c\u00e1c bi\u1ec7n ph\u00e1p ng\u0103n ch\u1eb7n \u0111\u1ec3 ng\u0103n ch\u1eb7n ransomware tr\u01b0\u1edbc khi g\u00e2y h\u1ea1i cho h\u1ec7 th\u1ed1ng. C\u00e1c bi\u1ec7n ph\u00e1p n\u00e0y c\u00f3 th\u1ec3 bao g\u1ed3m c\u00e1ch ly quy tr\u00ecnh, ch\u1eb7n quy tr\u00ecnh ho\u1eb7c t\u1ec7p, v\u00e0 c\u1ea3nh b\u00e1o ng\u01b0\u1eddi d\u00f9ng li\u00ean quan.<\/li>\n\n\n\n
    • T\u00ecnh hu\u1ed1ng th\u1ef1c t\u1ebf: <\/strong>M\u1ed9t quy tr\u00ecnh m\u1edbi b\u1eaft \u0111\u1ea7u th\u1ef1c thi tr\u00ean m\u00e1y ch\u1ee7 trong m\u1ea1ng n\u1ed9i b\u1ed9. Gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt theo d\u00f5i h\u00e0nh vi c\u1ee7a n\u00f3 v\u00e0 nh\u1eadn th\u1ea5y r\u1eb1ng quy tr\u00ecnh n\u00e0y \u0111ang ti\u1ebfn h\u00e0nh m\u00e3 h\u00f3a nhi\u1ec1u t\u1ec7p tr\u00ean m\u00e1y ch\u1ee7 v\u00e0 g\u1eedi c\u00e1c y\u00eau c\u1ea7u m\u1ea1ng \u0111\u00e1ng ng\u1edd \u0111\u1ebfn c\u00e1c \u0111\u1ecba ch\u1ec9 IP kh\u00f4ng r\u00f5. D\u1ef1a tr\u00ean h\u00e0nh vi n\u00e0y, gi\u1ea3i ph\u00e1p c\u1ea3nh b\u00e1o ng\u01b0\u1eddi qu\u1ea3n tr\u1ecb h\u1ec7 th\u1ed1ng v\u00e0 c\u00e1ch ly quy tr\u00ecnh n\u00e0y ngay l\u1eadp t\u1ee9c \u0111\u1ec3 ng\u0103n ch\u1eb7n ransomware kh\u1ecfi vi\u1ec7c g\u00e2y h\u1ea1i v\u00e0 l\u00e2y lan trong m\u1ea1ng.<\/li>\n<\/ul>\n\n\n\n

      2.3 Machine Learning v\u00e0 AI (Artificial Intelligence).<\/strong><\/p>\n\n\n\n

      C\u00e1ch ho\u1ea1t \u0111\u1ed9ng:<\/strong> S\u1eed d\u1ee5ng h\u1ecdc m\u00e1y v\u00e0 tr\u00ed tu\u1ec7 nh\u00e2n t\u1ea1o \u0111\u1ec3 x\u00e2y d\u1ef1ng m\u00f4 h\u00ecnh d\u1ef1 \u0111o\u00e1n v\u00e0 ph\u00e1t hi\u1ec7n ransomware d\u1ef1a tr\u00ean h\u1ecdc t\u1eeb c\u00e1c m\u1eabu d\u1eef li\u1ec7u \u0111\u00e3 bi\u1ebft. M\u00f4 h\u00ecnh s\u1ebd h\u1ecdc t\u1eeb c\u00e1c \u0111\u1eb7c tr\u01b0ng v\u00e0 m\u1eabu h\u00e0nh vi c\u1ee7a ransomware \u0111\u00e3 bi\u1ebft \u0111\u1ec3 nh\u1eadn di\u1ec7n c\u00e1c bi\u1ebfn th\u1ec3 m\u1edbi v\u00e0 kh\u00f4ng r\u00f5.<\/p>\n\n\n\n

      \u01afu \u0111i\u1ec3m: <\/strong>Ph\u00e1t hi\u1ec7n hi\u1ec7u qu\u1ea3 c\u00e1c bi\u1ebfn th\u1ec3 ransomware m\u1edbi v\u00e0 ch\u01b0a bi\u1ebft.<\/p>\n\n\n\n

      H\u1ea1n ch\u1ebf: <\/strong>C\u1ea7n m\u1ed9t l\u01b0\u1ee3ng l\u1edbn d\u1eef li\u1ec7u hu\u1ea5n luy\u1ec7n \u0111\u00e1ng tin c\u1eady v\u00e0 c\u00f3 th\u1ec3 \u0111\u00f2i h\u1ecfi t\u00e0i nguy\u00ean t\u00ednh to\u00e1n cao.<\/p>\n\n\n

      \n
      \"\"<\/figure>\n<\/div>\n\n\n

      V\u00ed d\u1ee5:<\/strong> Gi\u1ea3 s\u1eed m\u1ed9t t\u1ed5 ch\u1ee9c \u0111\u00e3 tri\u1ec3n khai m\u1ed9t gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt c\u00f3 s\u1eed d\u1ee5ng Machine Learning \u0111\u1ec3 ph\u00e1t hi\u1ec7n ransomware tr\u00ean c\u00e1c m\u00e1y t\u00ednh trong m\u1ea1ng n\u1ed9i b\u1ed9. Gi\u1ea3i ph\u00e1p n\u00e0y \u0111\u00e3 \u0111\u01b0\u1ee3c hu\u1ea5n luy\u1ec7n tr\u00ean m\u1ed9t l\u01b0\u1ee3ng l\u1edbn d\u1eef li\u1ec7u \u0111\u00e3 bi\u1ebft v\u1ec1 c\u00e1c bi\u1ebfn th\u1ec3 ransomware t\u1eeb qu\u00e1 kh\u1ee9.<\/p>\n\n\n\n

        \n
      • Hu\u1ea5n luy\u1ec7n m\u00f4 h\u00ecnh:<\/strong> \u0110\u1ea7u ti\u00ean, gi\u1ea3i ph\u00e1p n\u00e0y \u0111\u00e3 \u0111\u01b0\u1ee3c hu\u1ea5n luy\u1ec7n tr\u00ean m\u1ed9t t\u1eadp d\u1eef li\u1ec7u m\u1eabu bao g\u1ed3m c\u00e1c m\u1eabu d\u1eef li\u1ec7u \u0111\u00e3 bi\u1ebft v\u1ec1 ransomware v\u00e0 c\u00e1c m\u1eabu d\u1eef li\u1ec7u kh\u00f4ng li\u00ean quan \u0111\u1ebfn ransomware. D\u1eef li\u1ec7u \u0111\u00e3 bi\u1ebft bao g\u1ed3m c\u00e1c t\u1ec7p ransomware \u0111\u00e3 bi\u1ebft v\u1edbi c\u00e1c t\u00ednh n\u0103ng \u0111\u1eb7c tr\u01b0ng nh\u01b0 c\u00e1c h\u00e0nh vi m\u00e3 h\u00f3a d\u1eef li\u1ec7u, t\u1ea1o quy tr\u00ecnh \u0111\u00e1ng ng\u1edd, v\u00e0 ho\u1ea1t \u0111\u1ed9ng m\u1ea1ng b\u1ea5t th\u01b0\u1eddng.<\/li>\n\n\n\n
      • X\u00e1c \u0111\u1ecbnh t\u00ednh n\u0103ng (Feature Engineering): <\/strong>Tr\u01b0\u1edbc khi hu\u1ea5n luy\u1ec7n, c\u00e1c t\u00ednh n\u0103ng quan tr\u1ecdng c\u1ee7a d\u1eef li\u1ec7u \u0111\u00e3 \u0111\u01b0\u1ee3c x\u00e1c \u0111\u1ecbnh v\u00e0 tr\u00edch xu\u1ea5t. C\u00e1c t\u00ednh n\u0103ng n\u00e0y c\u00f3 th\u1ec3 bao g\u1ed3m th\u1eddi gian m\u00e3 h\u00f3a t\u1ec7p, s\u1ed1 l\u01b0\u1ee3ng t\u1ec7p b\u1ecb m\u00e3 h\u00f3a, t\u1ea7n su\u1ea5t g\u1eedi y\u00eau c\u1ea7u m\u1ea1ng, v.v.<\/li>\n\n\n\n
      • Hu\u1ea5n luy\u1ec7n m\u00f4 h\u00ecnh ML: <\/strong>Sau khi \u0111\u00e3 x\u00e1c \u0111\u1ecbnh t\u00ednh n\u0103ng, m\u00f4 h\u00ecnh Machine Learning (v\u00ed d\u1ee5: m\u1ea1ng n\u01a1-ron nh\u00e2n t\u1ea1o, m\u00e1y h\u1ecdc c\u00f3 gi\u00e1m s\u00e1t) \u0111\u01b0\u1ee3c hu\u1ea5n luy\u1ec7n tr\u00ean t\u1eadp d\u1eef li\u1ec7u \u0111\u00e3 bi\u1ebft. M\u00f4 h\u00ecnh h\u1ecdc c\u00e1ch nh\u1eadn bi\u1ebft c\u00e1c t\u00ednh n\u0103ng c\u1ee7a ransomware v\u00e0 ph\u00e2n lo\u1ea1i ch\u00fang l\u00e0 “ransomware” ho\u1eb7c “kh\u00f4ng ph\u1ea3i ransomware”.<\/li>\n\n\n\n
      • Ki\u1ec3m tra v\u00e0 \u0111\u00e1nh gi\u00e1:<\/strong> Sau khi hu\u1ea5n luy\u1ec7n, gi\u1ea3i ph\u00e1p n\u00e0y \u0111\u01b0\u1ee3c ki\u1ec3m tra v\u00e0 \u0111\u00e1nh gi\u00e1 tr\u00ean c\u00e1c t\u1eadp d\u1eef li\u1ec7u th\u1eed nghi\u1ec7m ho\u1eb7c th\u1ef1c t\u1ebf. N\u00f3 ti\u1ebfn h\u00e0nh ph\u00e2n lo\u1ea1i c\u00e1c t\u1ec7p v\u00e0 quy tr\u00ecnh m\u1edbi d\u1ef1a tr\u00ean c\u00e1c t\u00ednh n\u0103ng \u0111\u00e3 h\u1ecdc t\u1eeb m\u00f4 h\u00ecnh.<\/li>\n\n\n\n
      • Ph\u00e1t hi\u1ec7n ransomware: <\/strong>Khi m\u1ed9t t\u1ec7p ho\u1eb7c quy tr\u00ecnh m\u1edbi \u0111\u01b0\u1ee3c th\u1ef1c thi, gi\u1ea3i ph\u00e1p Machine Learning n\u00e0y so s\u00e1nh c\u00e1c t\u00ednh n\u0103ng c\u1ee7a n\u00f3 v\u1edbi m\u00f4 h\u00ecnh \u0111\u00e3 hu\u1ea5n luy\u1ec7n tr\u01b0\u1edbc \u0111\u00f3. N\u1ebfu c\u00e1c t\u00ednh n\u0103ng tr\u00f9ng kh\u1edbp v\u1edbi ransomware, m\u00f4 h\u00ecnh s\u1ebd \u0111\u01b0a ra d\u1ef1 \u0111o\u00e1n l\u00e0 “ransomware” v\u00e0 k\u00edch ho\u1ea1t bi\u1ec7n ph\u00e1p ng\u0103n ch\u1eb7n \u0111\u1ec3 ng\u0103n ch\u1eb7n ransomware tr\u01b0\u1edbc khi g\u00e2y h\u1ea1i cho h\u1ec7 th\u1ed1ng.<\/li>\n<\/ul>\n\n\n\n

        2.4 Ph\u00e2n t\u00edch h\u00e0nh vi (Behavior Analysis).<\/strong><\/p>\n\n\n\n

        C\u00e1ch ho\u1ea1t \u0111\u1ed9ng: <\/strong>Theo d\u00f5i h\u00e0nh vi c\u1ee7a c\u00e1c ch\u01b0\u01a1ng tr\u00ecnh v\u00e0 quy tr\u00ecnh tr\u00ean h\u1ec7 th\u1ed1ng \u0111\u1ec3 ph\u00e1t hi\u1ec7n c\u00e1c ho\u1ea1t \u0111\u1ed9ng kh\u00f4ng b\u00ecnh th\u01b0\u1eddng ho\u1eb7c \u0111\u00e1ng ng\u1edd. V\u00ed d\u1ee5, ph\u00e2n t\u00edch h\u00e0nh vi m\u00e3 h\u00f3a d\u1eef li\u1ec7u ho\u1eb7c t\u1ea1o ra c\u00e1c k\u1ebft n\u1ed1i m\u1ea1ng kh\u00f4ng b\u00ecnh th\u01b0\u1eddng c\u00f3 th\u1ec3 l\u00e0 d\u1ea5u hi\u1ec7u c\u1ee7a ransomware.<\/p>\n\n\n\n

        \u01afu \u0111i\u1ec3m: <\/strong>Ph\u00e1t hi\u1ec7n c\u00e1c ho\u1ea1t \u0111\u1ed9ng kh\u00f4ng r\u00f5 ho\u1eb7c kh\u00f4ng b\u00ecnh th\u01b0\u1eddng c\u1ee7a ransomware.<\/p>\n\n\n\n

        H\u1ea1n ch\u1ebf:<\/strong> C\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn vi\u1ec7c x\u00e1c \u0111\u1ecbnh sai khi m\u1ed9t \u1ee9ng d\u1ee5ng h\u1ee3p ph\u00e1p th\u1ef1c hi\u1ec7n c\u00e1c ho\u1ea1t \u0111\u1ed9ng t\u01b0\u01a1ng t\u1ef1.<\/p>\n\n\n

        \n
        \"\"<\/figure>\n<\/div>\n\n\n

        V\u00ed d\u1ee5: <\/strong>Gi\u1ea3 s\u1eed m\u1ed9t doanh nghi\u1ec7p tri\u1ec3n khai m\u1ed9t gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt m\u1ea1ng m\u00e0 s\u1eed d\u1ee5ng k\u1ef9 thu\u1eadt Behavior Analysis \u0111\u1ec3 ph\u00e1t hi\u1ec7n ransomware trong m\u1ea1ng n\u1ed9i b\u1ed9.<\/p>\n\n\n\n

          \n
        • H\u1ecdc t\u1eeb m\u1eabu h\u00e0nh vi ransomware \u0111\u00e3 bi\u1ebft:<\/strong> Tr\u01b0\u1edbc khi tri\u1ec3n khai, gi\u1ea3i ph\u00e1p n\u00e0y \u0111\u00e3 \u0111\u01b0\u1ee3c hu\u1ea5n luy\u1ec7n tr\u00ean m\u1ed9t t\u1eadp d\u1eef li\u1ec7u m\u1eabu bao g\u1ed3m c\u00e1c m\u1eabu d\u1eef li\u1ec7u \u0111\u00e3 bi\u1ebft v\u1ec1 h\u00e0nh vi c\u1ee7a ransomware. C\u00e1c m\u1eabu n\u00e0y bao g\u1ed3m c\u00e1c h\u00e0nh vi nh\u01b0 m\u00e3 h\u00f3a d\u1eef li\u1ec7u, t\u1ea1o quy tr\u00ecnh \u0111\u00e1ng ng\u1edd, y\u00eau c\u1ea7u m\u00e3 h\u00f3a th\u00f4ng qua m\u1ea1ng, v.v.<\/li>\n\n\n\n
        • X\u00e1c \u0111\u1ecbnh c\u00e1c t\u00ednh n\u0103ng h\u00e0nh vi \u0111\u00e1ng ng\u1edd: <\/strong>Trong qu\u00e1 tr\u00ecnh hu\u1ea5n luy\u1ec7n, gi\u1ea3i ph\u00e1p \u0111\u00e3 h\u1ecdc t\u1eeb c\u00e1c t\u00ednh n\u0103ng \u0111\u1eb7c tr\u01b0ng c\u1ee7a ransomware, nh\u01b0 t\u1ea7n su\u1ea5t y\u00eau c\u1ea7u m\u1ea1ng l\u1edbn, s\u1ef1 thay \u0111\u1ed5i t\u1ec7p \u0111\u1ed9t ng\u1ed9t, s\u1eed d\u1ee5ng m\u00e3 h\u00f3a kh\u00f4ng ph\u1ed5 bi\u1ebfn, v.v. C\u00e1c t\u00ednh n\u0103ng n\u00e0y gi\u00fap x\u00e1c \u0111\u1ecbnh c\u00e1c h\u00e0nh vi \u0111\u00e1ng ng\u1edd trong t\u01b0\u01a1ng lai.<\/li>\n\n\n\n
        • Theo d\u00f5i h\u00e0nh vi m\u1edbi: <\/strong>Khi m\u1ed9t m\u00e1y t\u00ednh trong m\u1ea1ng th\u1ef1c hi\u1ec7n m\u1ed9t h\u00e0nh \u0111\u1ed9ng m\u1edbi, gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt s\u1ebd theo d\u00f5i v\u00e0 ph\u00e2n t\u00edch h\u00e0nh vi c\u1ee7a n\u00f3. N\u00f3 s\u1ebd quan s\u00e1t c\u00e1c ho\u1ea1t \u0111\u1ed9ng nh\u01b0 thay \u0111\u1ed5i t\u1ec7p quan tr\u1ecdng, th\u1ef1c hi\u1ec7n m\u00e3 h\u00f3a \u0111\u1ed1i v\u1edbi nhi\u1ec1u t\u1ec7p, t\u1ea1o quy tr\u00ecnh b\u1ea5t th\u01b0\u1eddng, v.v.<\/li>\n\n\n\n
        • X\u00e1c \u0111\u1ecbnh h\u00e0nh vi ransomware \u0111\u00e1ng ng\u1edd:<\/strong> D\u1ef1a tr\u00ean c\u00e1c t\u00ednh n\u0103ng h\u00e0nh vi \u0111\u00e3 h\u1ecdc, gi\u1ea3i ph\u00e1p s\u1ebd x\u00e1c \u0111\u1ecbnh xem h\u00e0nh vi hi\u1ec7n t\u1ea1i c\u00f3 kh\u1edbp v\u1edbi c\u00e1c bi\u1ec3u hi\u1ec7n c\u1ee7a ransomware \u0111\u00e3 bi\u1ebft hay kh\u00f4ng. N\u1ebfu gi\u1ea3i ph\u00e1p nh\u1eadn ra m\u1ed9t h\u00e0nh vi \u0111\u00e1ng ng\u1edd, n\u00f3 s\u1ebd c\u1ea3nh b\u00e1o ng\u01b0\u1eddi qu\u1ea3n tr\u1ecb h\u1ec7 th\u1ed1ng ho\u1eb7c th\u1ef1c hi\u1ec7n c\u00e1c bi\u1ec7n ph\u00e1p ng\u0103n ch\u1eb7n \u0111\u1ec3 ki\u1ec3m tra v\u00e0 x\u1eed l\u00fd s\u1ef1 c\u1ed1.<\/li>\n\n\n\n
        • Ph\u1ea3n \u1ee9ng v\u00e0 bi\u1ec7n ph\u00e1p ng\u0103n ch\u1eb7n: <\/strong>N\u1ebfu gi\u1ea3i ph\u00e1p ph\u00e1t hi\u1ec7n m\u1ed9t h\u00e0nh vi ransomware \u0111\u00e1ng ng\u1edd, n\u00f3 s\u1ebd c\u1ea3nh b\u00e1o ng\u01b0\u1eddi qu\u1ea3n tr\u1ecb v\u00e0 th\u1ef1c hi\u1ec7n c\u00e1c bi\u1ec7n ph\u00e1p ng\u0103n ch\u1eb7n, ch\u1eb3ng h\u1ea1n nh\u01b0 c\u00e1ch ly m\u00e1y t\u00ednh, ch\u1eb7n k\u1ebft n\u1ed1i m\u1ea1ng, v.v. N\u1ebfu h\u00e0nh vi x\u00e1c \u0111\u1ecbnh l\u00e0 ransomware, gi\u1ea3i ph\u00e1p s\u1ebd ng\u0103n ch\u1eb7n n\u00f3 tr\u01b0\u1edbc khi g\u00e2y h\u1ea1i cho h\u1ec7 th\u1ed1ng.<\/li>\n\n\n\n
        • T\u00ecnh hu\u1ed1ng th\u1ef1c t\u1ebf: <\/strong>M\u1ed9t m\u00e1y t\u00ednh trong m\u1ea1ng b\u1ea5t th\u01b0\u1eddng th\u1ef1c hi\u1ec7n m\u00e3 h\u00f3a nhi\u1ec1u t\u1ec7p quan tr\u1ecdng v\u00e0 g\u1eedi l\u01b0\u1ee3ng l\u1edbn y\u00eau c\u1ea7u m\u1ea1ng \u0111\u1ebfn c\u00e1c \u0111\u1ecba ch\u1ec9 IP kh\u00f4ng ph\u1ed5 bi\u1ebfn. Gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt \u0111\u00e3 h\u1ecdc t\u1eeb m\u1eabu h\u00e0nh vi ransomware \u0111\u00e3 bi\u1ebft v\u00e0 x\u00e1c \u0111\u1ecbnh r\u1eb1ng h\u00e0nh vi n\u00e0y \u0111\u00e1ng ng\u1edd. N\u00f3 c\u1ea3nh b\u00e1o ng\u01b0\u1eddi qu\u1ea3n tr\u1ecb h\u1ec7 th\u1ed1ng v\u00e0 ch\u1eb7n k\u1ebft n\u1ed1i m\u1ea1ng c\u1ee7a m\u00e1y t\u00ednh n\u00e0y \u0111\u1ec3 ng\u0103n ch\u1eb7n ransomware kh\u1ecfi vi\u1ec7c l\u00e2y lan v\u00e0 m\u00e3 h\u00f3a th\u00eam t\u1ec7p trong m\u1ea1ng.<\/li>\n<\/ul>\n\n\n\n

          2.5 Sandboxing.<\/strong><\/p>\n\n\n\n

          C\u00e1ch ho\u1ea1t \u0111\u1ed9ng: <\/strong>C\u00e1c h\u1ec7 th\u1ed1ng sandboxing cho ph\u00e9p ch\u1ea1y c\u00e1c t\u1ec7p v\u00e0 quy tr\u00ecnh kh\u00f4ng r\u00f5 trong m\u00f4i tr\u01b0\u1eddng c\u00f4 l\u1eadp \u0111\u1ec3 xem ch\u00fang c\u00f3 h\u00e0nh vi c\u1ee7a ransomware hay kh\u00f4ng. N\u1ebfu \u0111\u01b0\u1ee3c x\u00e1c \u0111\u1ecbnh l\u00e0 ransomware, n\u00f3 s\u1ebd b\u1ecb ng\u0103n ch\u1eb7n tr\u01b0\u1edbc khi c\u00f3 th\u1ec3 t\u1ea5n c\u00f4ng v\u00e0o h\u1ec7 th\u1ed1ng.<\/p>\n\n\n\n

          \u01afu \u0111i\u1ec3m: <\/strong>Ph\u00e1t hi\u1ec7n ch\u00ednh x\u00e1c c\u00e1c ho\u1ea1t \u0111\u1ed9ng ransomware b\u1eb1ng c\u00e1ch ch\u1ea1y ch\u00fang trong m\u00f4i tr\u01b0\u1eddng c\u00f4 l\u1eadp.<\/p>\n\n\n\n

          H\u1ea1n ch\u1ebf:<\/strong> \u0110\u00f2i h\u1ecfi t\u00e0i nguy\u00ean v\u00e0 th\u1eddi gian \u0111\u1ec3 ch\u1ea1y c\u00e1c t\u1ec7p trong m\u00f4i tr\u01b0\u1eddng sandboxing.<\/p>\n\n\n

          \n
          \"\"<\/figure>\n<\/div>\n\n\n

          V\u00ed d\u1ee5:<\/strong> M\u1ed9t doanh nghi\u1ec7p tri\u1ec3n khai m\u1ed9t gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt m\u1ea1ng c\u00f3 t\u00edch h\u1ee3p c\u00f4ng ngh\u1ec7 Sandboxing \u0111\u1ec3 ph\u00e1t hi\u1ec7n ransomware v\u00e0 c\u00e1c m\u1ed1i \u0111e d\u1ecda kh\u00e1c.<\/p>\n\n\n\n

            \n
          • Th\u1ef1c thi t\u1ec7p trong m\u00f4i tr\u01b0\u1eddng sandbox c\u00f4 l\u1eadp:<\/strong> Khi m\u1ed9t t\u1ec7p m\u1edbi \u0111\u01b0\u1ee3c t\u1ea3i xu\u1ed1ng t\u1eeb m\u1ea1ng ho\u1eb7c g\u1eedi \u0111\u1ebfn qua email, gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt s\u1ebd x\u00e1c \u0111\u1ecbnh r\u1eb1ng t\u1ec7p n\u00e0y kh\u00f4ng \u0111\u01b0\u1ee3c x\u00e1c \u0111\u1ecbnh ho\u1eb7c \u0111\u00e3 \u0111\u01b0\u1ee3c x\u1ebfp v\u00e0o danh s\u00e1ch nguy hi\u1ec3m. \u0110\u1ec3 x\u00e1c \u0111\u1ecbnh li\u1ec7u t\u1ec7p c\u00f3 ph\u1ea3i l\u00e0 ransomware hay kh\u00f4ng, gi\u1ea3i ph\u00e1p s\u1ebd th\u1ef1c thi t\u1ec7p trong m\u00f4i tr\u01b0\u1eddng sandbox c\u00f4 l\u1eadp, t\u1ee9c l\u00e0 m\u1ed9t kh\u00f4ng gian \u1ea3o v\u00e0 ri\u00eang bi\u1ec7t ho\u1ea1t \u0111\u1ed9ng \u0111\u1ed9c l\u1eadp v\u1edbi h\u1ec7 th\u1ed1ng ch\u00ednh.<\/li>\n\n\n\n
          • Quan s\u00e1t h\u00e0nh vi trong m\u00f4i tr\u01b0\u1eddng c\u00f4 l\u1eadp: <\/strong>Khi t\u1ec7p \u0111\u01b0\u1ee3c th\u1ef1c thi trong m\u00f4i tr\u01b0\u1eddng sandbox, gi\u1ea3i ph\u00e1p s\u1ebd quan s\u00e1t c\u00e1c h\u00e0nh vi c\u1ee7a n\u00f3, ch\u1eb3ng h\u1ea1n nh\u01b0 c\u00e1c ho\u1ea1t \u0111\u1ed9ng t\u1ea1o, m\u00e3 h\u00f3a ho\u1eb7c x\u00f3a t\u1ec7p, c\u00e1c y\u00eau c\u1ea7u m\u1ea1ng \u0111\u00e1ng ng\u1edd, t\u1ea1o quy tr\u00ecnh \u0111\u00e1ng ng\u1edd, v.v.<\/li>\n\n\n\n
          • Ph\u00e2n t\u00edch k\u1ebft qu\u1ea3:<\/strong> Sau khi t\u1ec7p \u0111\u01b0\u1ee3c th\u1ef1c thi v\u00e0 h\u00e0nh vi c\u1ee7a n\u00f3 \u0111\u01b0\u1ee3c quan s\u00e1t, gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt s\u1ebd ph\u00e2n t\u00edch k\u1ebft qu\u1ea3. N\u1ebfu h\u00e0nh vi c\u1ee7a t\u1ec7p \u0111\u01b0\u1ee3c x\u00e1c \u0111\u1ecbnh l\u00e0 ransomware, gi\u1ea3i ph\u00e1p s\u1ebd \u0111\u01b0a ra c\u1ea3nh b\u00e1o v\u00e0 th\u1ef1c hi\u1ec7n c\u00e1c bi\u1ec7n ph\u00e1p ng\u0103n ch\u1eb7n.<\/li>\n\n\n\n
          • Bi\u1ec7n ph\u00e1p ng\u0103n ch\u1eb7n v\u00e0 x\u1eed l\u00fd:<\/strong> N\u1ebfu gi\u1ea3i ph\u00e1p ph\u00e1t hi\u1ec7n t\u1ec7p l\u00e0 ransomware sau khi th\u1ef1c thi trong m\u00f4i tr\u01b0\u1eddng sandbox, n\u00f3 s\u1ebd th\u1ef1c hi\u1ec7n c\u00e1c bi\u1ec7n ph\u00e1p ng\u0103n ch\u1eb7n \u0111\u1ec3 ch\u1eb7n t\u1ec7p n\u00e0y v\u00e0 ng\u0103n ch\u1eb7n ransomware l\u00e2y lan trong m\u1ea1ng. C\u00e1c bi\u1ec7n ph\u00e1p n\u00e0y c\u00f3 th\u1ec3 bao g\u1ed3m c\u00e1ch ly t\u1ec7p, ch\u1eb7n k\u1ebft n\u1ed1i m\u1ea1ng, th\u00f4ng b\u00e1o cho ng\u01b0\u1eddi qu\u1ea3n tr\u1ecb v.v.<\/li>\n\n\n\n
          • T\u00ecnh hu\u1ed1ng th\u1ef1c t\u1ebf:<\/strong> M\u1ed9t nh\u00e2n vi\u00ean trong doanh nghi\u1ec7p nh\u1eadn \u0111\u01b0\u1ee3c m\u1ed9t email \u0111\u00e1ng ng\u1edd v\u1edbi m\u1ed9t t\u1ec7p \u0111\u00ednh k\u00e8m kh\u00f4ng r\u00f5 ngu\u1ed3n g\u1ed1c. H\u1ec7 th\u1ed1ng b\u1ea3o m\u1eadt c\u1ee7a doanh nghi\u1ec7p nh\u1eadn di\u1ec7n email n\u00e0y l\u00e0 nguy hi\u1ec3m v\u00e0 quy\u1ebft \u0111\u1ecbnh th\u1ef1c thi t\u1ec7p \u0111\u00ednh k\u00e8m trong m\u00f4i tr\u01b0\u1eddng sandbox c\u00f4 l\u1eadp. Khi t\u1ec7p \u0111\u01b0\u1ee3c th\u1ef1c thi, h\u1ec7 th\u1ed1ng quan s\u00e1t r\u1eb1ng n\u00f3 \u0111ang th\u1ef1c hi\u1ec7n m\u00e3 h\u00f3a tr\u00ean nhi\u1ec1u t\u1ec7p trong m\u00f4i tr\u01b0\u1eddng sandbox. D\u1ef1a tr\u00ean h\u00e0nh vi n\u00e0y, h\u1ec7 th\u1ed1ng k\u1ebft lu\u1eadn r\u1eb1ng t\u1ec7p n\u00e0y c\u00f3 kh\u1ea3 n\u0103ng l\u00e0 ransomware v\u00e0 ng\u0103n ch\u1eb7n t\u1ec7p n\u00e0y tho\u00e1t ra kh\u1ecfi m\u00f4i tr\u01b0\u1eddng sandbox v\u00e0 l\u00e2y lan trong h\u1ec7 th\u1ed1ng ch\u00ednh.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

            C\u00f4ng ngh\u1ec7 ph\u00e1t hi\u1ec7n ransomware l\u00e0 m\u1ed9t t\u1eadp h\u1ee3p c\u00e1c k\u1ef9 thu\u1eadt v\u00e0 c\u01a1 ch\u1ebf \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 x\u00e1c \u0111\u1ecbnh v\u00e0 nh\u1eadn bi\u1ebft s\u1ef1 hi\u1ec7n di\u1ec7n c\u1ee7a ransomware trong h\u1ec7 th\u1ed1ng ho\u1eb7c thi\u1ebft b\u1ecb. M\u1ee5c ti\u00eau c\u1ee7a c\u00f4ng ngh\u1ec7 n\u00e0y l\u00e0 ph\u00e1t hi\u1ec7n v\u00e0 ng\u0103n ch\u1eb7n ransomware tr\u01b0\u1edbc khi n\u00f3 c\u00f3 th\u1ec3 g\u00e2y h\u1ea1i […]<\/p>\n","protected":false},"author":12,"featured_media":7182,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_eb_attr":"","ocean_post_layout":"","ocean_both_sidebars_style":"","ocean_both_sidebars_content_width":0,"ocean_both_sidebars_sidebars_width":0,"ocean_sidebar":"","ocean_second_sidebar":"","ocean_disable_margins":"enable","ocean_add_body_class":"","ocean_shortcode_before_top_bar":"","ocean_shortcode_after_top_bar":"","ocean_shortcode_before_header":"","ocean_shortcode_after_header":"","ocean_has_shortcode":"","ocean_shortcode_after_title":"","ocean_shortcode_before_footer_widgets":"","ocean_shortcode_after_footer_widgets":"","ocean_shortcode_before_footer_bottom":"","ocean_shortcode_after_footer_bottom":"","ocean_display_top_bar":"default","ocean_display_header":"default","ocean_header_style":"","ocean_center_header_left_menu":"","ocean_custom_header_template":"","ocean_custom_logo":0,"ocean_custom_retina_logo":0,"ocean_custom_logo_max_width":0,"ocean_custom_logo_tablet_max_width":0,"ocean_custom_logo_mobile_max_width":0,"ocean_custom_logo_max_height":0,"ocean_custom_logo_tablet_max_height":0,"ocean_custom_logo_mobile_max_height":0,"ocean_header_custom_menu":"","ocean_menu_typo_font_family":"","ocean_menu_typo_font_subset":"","ocean_menu_typo_font_size":0,"ocean_menu_typo_font_size_tablet":0,"ocean_menu_typo_font_size_mobile":0,"ocean_menu_typo_font_size_unit":"px","ocean_menu_typo_font_weight":"","ocean_menu_typo_font_weight_tablet":"","ocean_menu_typo_font_weight_mobile":"","ocean_menu_typo_transform":"","ocean_menu_typo_transform_tablet":"","ocean_menu_typo_transform_mobile":"","ocean_menu_typo_line_height":0,"ocean_menu_typo_line_height_tablet":0,"ocean_menu_typo_line_height_mobile":0,"ocean_menu_typo_line_height_unit":"","ocean_menu_typo_spacing":0,"ocean_menu_typo_spacing_tablet":0,"ocean_menu_typo_spacing_mobile":0,"ocean_menu_typo_spacing_unit":"","ocean_menu_link_color":"","ocean_menu_link_color_hover":"","ocean_menu_link_color_active":"","ocean_menu_link_background":"","ocean_menu_link_hover_background":"","ocean_menu_link_active_background":"","ocean_menu_social_links_bg":"","ocean_menu_social_hover_links_bg":"","ocean_menu_social_links_color":"","ocean_menu_social_hover_links_color":"","ocean_disable_title":"default","ocean_disable_heading":"default","ocean_post_title":"","ocean_post_subheading":"","ocean_post_title_style":"","ocean_post_title_background_color":"","ocean_post_title_background":0,"ocean_post_title_bg_image_position":"","ocean_post_title_bg_image_attachment":"","ocean_post_title_bg_image_repeat":"","ocean_post_title_bg_image_size":"","ocean_post_title_height":0,"ocean_post_title_bg_overlay":0.5,"ocean_post_title_bg_overlay_color":"","ocean_disable_breadcrumbs":"default","ocean_breadcrumbs_color":"","ocean_breadcrumbs_separator_color":"","ocean_breadcrumbs_links_color":"","ocean_breadcrumbs_links_hover_color":"","ocean_display_footer_widgets":"default","ocean_display_footer_bottom":"default","ocean_custom_footer_template":"","ocean_post_oembed":"","ocean_post_self_hosted_media":"","ocean_post_video_embed":"","ocean_link_format":"","ocean_link_format_target":"self","ocean_quote_format":"","ocean_quote_format_link":"post","ocean_gallery_link_images":"on","ocean_gallery_id":[],"footnotes":""},"categories":[80],"tags":[187,188,189,190,92],"class_list":["post-7170","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-huong-dan-tai-lieu","tag-ai","tag-behavioral-detection","tag-hash-based-detection","tag-machine-learning","tag-ransomware","entry","has-media"],"_links":{"self":[{"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/posts\/7170","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/comments?post=7170"}],"version-history":[{"count":0,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/posts\/7170\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/media\/7182"}],"wp:attachment":[{"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/media?parent=7170"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/categories?post=7170"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/tags?post=7170"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}