Leveraging Machine Learning Techniques for Windows Ransomware Network Traffic Detection

Abstract

Ransomware has become a significant global threat with the ransomware-as-a-service model enabling easy availability and deployment, and the potential for high revenues creating a viable criminal business model. Individuals, private companies or public service providers e.g. healthcare or utilities companies can all become victims of ransomware attacks and consequently suffer severe disruption and financial loss. Although machine learning algorithms are already being used to detect ransomware, variants are being developed to specifically evade detection when using dynamic machine learning techniques. In this paper, we introduce NetConverse, a machine learning analysis of Windows ransomware network traffic to achieve a high, consistent detection rate. Using a dataset created from conversation-based network traffic features we achieved a true positive detection rate of 97.1% using the Decision Tree (J48) classifier.

arXiv comment11 Pages

References in corpus (7)

• Know Abnormal, Find Evil: Frequent Pattern Mining for Ransomware Threat Hunting and Intelligence
• Automated Dynamic Analysis of Ransomware: Benefits, Limitations and use for Detection
• A Cyber Kill Chain Based Taxonomy of Banking Trojans for Evolutionary Computational Intelligence
• CloudMe Forensics: A Case of Big-Data Investigation
• Greening Cloud-Enabled Big Data Storage Forensics: Syncany as a Case Study
• Exploit Kits: The production line of the Cybercrime Economy
• Automated detection and classification of cryptographic algorithms in binary programs through machine learning

Cited by in corpus (7)

• A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutions
• Cyber Threat Intelligence : Challenges and Opportunities
• Leveraging Support Vector Machine for Opcode Density Based Detection of Crypto-Ransomware
• Ransomware Detection and Classification Strategies
• Ransomware: Analysing the Impact on Windows Active Directory Domain Services
• Data-Centric Machine Learning Approach for Early Ransomware Detection and Attribution
• Towards resilient machine learning for ransomware detection