Bibliographic citations
Palomino, J., Cuneo, A., Gutierrez, E. (2024). Modelo de desarrollo de reglas de correlación para la detección y alerta de ransomware [Trabajo de investigación, Universidad Peruana de Ciencias Aplicadas (UPC)]. http://hdl.handle.net/10757/683792
Palomino, J., Cuneo, A., Gutierrez, E. Modelo de desarrollo de reglas de correlación para la detección y alerta de ransomware [Trabajo de investigación]. PE: Universidad Peruana de Ciencias Aplicadas (UPC); 2024. http://hdl.handle.net/10757/683792
@mastersthesis{renati/1052238,
title = "Modelo de desarrollo de reglas de correlación para la detección y alerta de ransomware",
author = "Gutierrez Arana, Eduardo Jose",
publisher = "Universidad Peruana de Ciencias Aplicadas (UPC)",
year = "2024"
}
In recent years, malware attacks have increased exponentially, due to the dependence on technology to manage public sector services and private sector business processes. This has allowed for profits, but also greater exposure to security breaches and vulnerabilities that have caused many economic losses for different industrial sectors. Among these computer dangers is ransomware, a type of malware that has a great impact on different industries and that operates by encrypting information to demand payments to the detriment of institutions and people. In this context, the present study proposed as a general objective "to implement a correlation rules model in the Security Information and Event Management System (SIEM) to effectively detect, prevent and mitigate ransomware attacks." Methodologically, a mixed design was chosen, based on the construction of a state of the art around the phenomenon and the validation of a model that meets the objective described above. Among the main findings or results obtained, it was found that the proposed model, based on the MITRE ATT&ACK knowledge base, offers mechanisms that allow the effective detection, prevention and mitigation of ransomware attacks. It should be noted that the model is made up of four cyclical phases, including planning, design, construction and improvement. Additionally, it was evident, after reviewing the literature, that there are 4 predominant types of this malware today. In summary, the study corroborated the possibility of creating a correlation rules model capable of detecting and alerting ransomware, which is significant theoretically and practically, considering the large losses caused by such attacks.
This item is licensed under a Creative Commons License