Format

Send to

Choose Destination
Sensors (Basel). 2019 Mar 5;19(5). pii: E1114. doi: 10.3390/s19051114.

Intelligent and Dynamic Ransomware Spread Detection and Mitigation in Integrated Clinical Environments.

Author information

1
Department of Computer Engineering, University of Murcia, 30100 Murcia, Spain. lfmaimo@um.es.
2
Telecommunications Software & Systems Group, Waterford Institute of Technology, X91 K0EK Waterford, Ireland. ahuertas@tssg.org.
3
Department of Computer Engineering, University of Murcia, 30100 Murcia, Spain. angelluis.perales@um.es.
4
Department of Computer Engineering, University of Murcia, 30100 Murcia, Spain. fgarcia@um.es.
5
Department of Computer & Information Science, University of Pennsylvania, Philadelphia, PA 19104-6309, USA. weimerj@seas.upenn.edu.
6
Department of Computer & Information Science, University of Pennsylvania, Philadelphia, PA 19104-6309, USA. lee@cis.upenn.edu.

Abstract

Medical Cyber-Physical Systems (MCPS) hold the promise of reducing human errors and optimizing healthcare by delivering new ways to monitor, diagnose and treat patients through integrated clinical environments (ICE). Despite the benefits provided by MCPS, many of the ICE medical devices have not been designed to satisfy cybersecurity requirements and, consequently, are vulnerable to recent attacks. Nowadays, ransomware attacks account for 85% of all malware in healthcare, and more than 70% of attacks confirmed data disclosure. With the goal of improving this situation, the main contribution of this paper is an automatic, intelligent and real-time system to detect, classify, and mitigate ransomware in ICE. The proposed solution is fully integrated with the ICE++ architecture, our previous work, and makes use of Machine Learning (ML) techniques to detect and classify the spreading phase of ransomware attacks affecting ICE. Additionally, Network Function Virtualization (NFV) and Software Defined Networking (SDN)paradigms are considered to mitigate the ransomware spreading by isolating and replacing infected devices. Different experiments returned a precision/recall of 92.32%/99.97% in anomaly detection, an accuracy of 99.99% in ransomware classification, and promising detection and mitigation times. Finally, different labelled ransomware datasets in ICE have been created and made publicly available.

KEYWORDS:

anomaly detection; cybersecurity; integrated clinical environments; medical cyber-physical systems; network function virtualization; ransomware classification; software-defined networking

Supplemental Content

Full text links

Icon for Multidisciplinary Digital Publishing Institute (MDPI) Icon for PubMed Central
Loading ...
Support Center