Research Article
Toward A Network-Assisted Approach for Effective Ransomware Detection
@ARTICLE{10.4108/eai.28-1-2021.168506, author={Tianrou Xia and Yuanyi Sun and Sencun Zhu and Zeeshan Rasheed and Khurram Shafique}, title={Toward A Network-Assisted Approach for Effective Ransomware Detection}, journal={EAI Endorsed Transactions on Security and Safety}, volume={7}, number={24}, publisher={EAI}, journal_a={SESA}, year={2021}, month={1}, keywords={ransomware detection, ant colony optimization algorithm, network security}, doi={10.4108/eai.28-1-2021.168506} }- Tianrou Xia
Yuanyi Sun
Sencun Zhu
Zeeshan Rasheed
Khurram Shafique
Year: 2021
Toward A Network-Assisted Approach for Effective Ransomware Detection
SESA
EAI
DOI: 10.4108/eai.28-1-2021.168506
Abstract
Ransomware is one kind of malware using cryptography to prevent victims from normal use of their computers. As a result, victims lose the access to their files and desktops unless they pay the ransom to the attackers. By the end of 2019, ransomware attack had caused more than 10 billion dollars of financial loss to enterprises and individuals. In this work, we propose a Network-Assisted Approach (NAA), which contains local detection and network-level detection, to help user determine whether a machine has been infected by ransomware. To evaluate its performance, we built 100 containers in Docker to simulate network scenarios. A hybrid ransomware sample which is close to real-world ransomware is deployed on stimulative infected machines. The experiment results show that our network-level detection mechanisms are separately applicable to WAN and LAN scenarios for ransomware detection.
Copyright © 2021 T. Xia et al., licensed to EAI. This is an open access article distributed under the terms of the Creative Commons Attribution license, which permits unlimited use, distribution and reproduction in any medium so long as the original work is properly cited.
