Software-Defined Networking-based Crypto Ransomware Detection Using HTTP Traffic Characteristics

Abstract

Ransomware is currently the key threat for individual as well as corporate Internet users. Especially dangerous is crypto ransomware that encrypts important user data and it is only possible to recover it once a ransom has been paid. Therefore devising efficient and effective countermeasures is a rising necessity. In this paper we present a novel Software-Defined Networking (SDN) based detection approach that utilizes characteristics of ransomware communication. Based on the observation of network communication of two crypto ransomware families, namely CryptoWall and Locky we conclude that analysis of the HTTP messages' sequences and their respective content sizes is enough to detect such threats. We show feasibility of our approach by designing and evaluating the proof-of-concept SDN-based detection system. Experimental results confirm that the proposed approach is feasible and efficient.

14 pages, 13 figures, 3 tables

References in corpus (2)

• Using Software-Defined Networking for Ransomware Mitigation: the Case of CryptoWall
• Automated Dynamic Analysis of Ransomware: Benefits, Limitations and use for Detection

Cited by in corpus (6)

• A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutions
• Redundancy Coefficient Gradual Up-weighting-based Mutual Information Feature Selection Technique for Crypto-ransomware Early Detection
• Ransomware Detection and Classification Strategies
• FedDICE: A ransomware spread detection in a distributed integrated clinical environment using federated learning and SDN based mitigation
• Towards resilient machine learning for ransomware detection
• Ransomware Analysis using Feature Engineering and Deep Neural Networks