Exploration of clustering overlaps in a ransomware network based on link structures and content relevance
type: CreativeWork
description: The advancement in technology makes it easy and effective to transmit and spread ransomware to different devices. The result is increased ransomware threats to different sectors of the World Economy. The reason for the spread of these threats is that Ransomware developers are trying to increase their revenue by infecting victims of specific (industry) sectors of the world economy with targeted ransomware to breach their security and steal valuable data. To counter these threats, industries employ different security measures to prevent ransomware-related losses, yet losses continue to occur because of the ever-changing dynamics of ransomware. Consequently, industries are continuously, searching for effective measures to control ransomware attacks. Forensic and security experts and law enforcement operatives also have limitations in the control of such security threats. The study of cluster analysis in none ransomware domains (e.g. complex social networks links and contents) has proved invaluable for the detection of cluster hubs, authorities, and communities in complex social networks. This has helped in targeted marketing activities and in the detection, identification, and prediction of terrorist and criminal hubs (gangs) within a network. That ransomware distribution and spread have similar complex network configuration to the social network, application of cluster analysis on the ransomware becomes a possible area of interest in the fight against ransomware threats. Compared to the social network, ransomware structure comprises of a set of links and contents, whose nodes (vertices) represent ransomware families, IP Addresses, URLs, Host, Registrar, ASNs, Countries, status or other entities embedded in the distribution. Real-time Active Cluster Overlap Profiling and Tracking (ACOPT) of ransomware network overlapping cluster trends presents an opportunity to prevent a successful attack. The study reveals there is active threat when the network events activity peaks…
abstract: The advancement in technology makes it easy and effective to transmit and spread ransomware to different devices. The result is increased ransomware threats to different sectors of the World Economy. The reason for the spread of these threats is that Ransomware developers are trying to increase their revenue by infecting victims of specific (industry) sectors of the world economy with targeted ransomware to breach their security and steal valuable data. To counter these threats, industries employ different security measures to prevent ransomware-related losses, yet losses continue to occur because of the ever-changing dynamics of ransomware. Consequently, industries are continuously, searching for effective measures to control ransomware attacks. Forensic and security experts and law enforcement operatives also have limitations in the control of such security threats. The study of cluster analysis in none ransomware domains (e.g. complex social networks links and contents) has proved invaluable for the detection of cluster hubs, authorities, and communities in complex social networks. This has helped in targeted marketing activities and in the detection, identification, and prediction of terrorist and criminal hubs (gangs) within a network. That ransomware distribution and spread have similar complex network configuration to the social network, application of cluster analysis on the ransomware becomes a possible area of interest in the fight against ransomware threats. Compared to the social network, ransomware structure comprises of a set of links and contents, whose nodes (vertices) represent ransomware families, IP Addresses, URLs, Host, Registrar, ASNs, Countries, status or other entities embedded in the distribution. Real-time Active Cluster Overlap Profiling and Tracking (ACOPT) of ransomware network overlapping cluster trends presents an opportunity to prevent a successful attack. The study reveals there is active threat when the network events activity peaks…
author: Ogazi-Onyemaechi, BC
language: en
date published: 2026
date modified: 2026-07-24T04:26:23Z
provider: U. of Salford
publisher: Networked Digital Library of Theses and Dissertations
type: WebPage
source organization: U. of Salford