CKC is a well-established model in industry that describes stages of cyber intrusion attempts. In this paper we provide, to the best of our knowledge, the first scientific taxonomy of ransomware features, aligned with Lockheed Martin Cyber Kill Chain (CKC) model.

Therefore, a ransomware feature taxonomy would advance cyber defenders’ understanding of associated risks of ransomware. Though the existing body of research provides significant discussions about ransomware details and capabilities, the all research body is fragmented. Wide range of features which are available in different families and versions of ransomware further complicates their detection and analysis. Although the ransomware attack strategy seems to be simple, security specialists ranked ransomware as a sophisticated attack vector with many variations and families. Majority of ransomware families are requesting for a ransom payment to restore a custodian access or decrypt data which were encrypted by the ransomware earlier. In spite of being just a few years old, ransomware is quickly becoming a serious threat to our digital infrastructures, data and services.

Crypto locker on machine