sesa 21(24): e3

Research Article

Toward A Network-Assisted Approach for Effective Ransomware Detection

Download211 downloads
  • @ARTICLE{10.4108/eai.28-1-2021.168506,
        author={Tianrou Xia and Yuanyi Sun and Sencun Zhu and Zeeshan Rasheed and Khurram Shafique},
        title={Toward A Network-Assisted Approach for Effective Ransomware Detection},
        journal={EAI Endorsed Transactions on Security and Safety},
        volume={7},
        number={24},
        publisher={EAI},
        journal_a={SESA},
        year={2021},
        month={1},
        keywords={ransomware detection, ant colony optimization algorithm, network security},
        doi={10.4108/eai.28-1-2021.168506}
    }
    
  • Tianrou Xia
    Yuanyi Sun
    Sencun Zhu
    Zeeshan Rasheed
    Khurram Shafique
    Year: 2021
    Toward A Network-Assisted Approach for Effective Ransomware Detection
    SESA
    EAI
    DOI: 10.4108/eai.28-1-2021.168506
Tianrou Xia1,*, Yuanyi Sun1, Sencun Zhu1, Zeeshan Rasheed2, Khurram Shafique2
  • 1: Dept. of Computer Science and Engineering, Pennsylvania State University, University Park, PA 16802, USA
  • 2: Novateur Research Solutions, VA 20147, USA
*Contact email: tzx17@psu.edu

Abstract

Ransomware is one kind of malware using cryptography to prevent victims from normal use of their computers. As a result, victims lose the access to their files and desktops unless they pay the ransom to the attackers. By the end of 2019, ransomware attack had caused more than 10 billion dollars of financial loss to enterprises and individuals. In this work, we propose a Network-Assisted Approach (NAA), which contains local detection and network-level detection, to help user determine whether a machine has been infected by ransomware. To evaluate its performance, we built 100 containers in Docker to simulate network scenarios. A hybrid ransomware sample which is close to real-world ransomware is deployed on stimulative infected machines. The experiment results show that our network-level detection mechanisms are separately applicable to WAN and LAN scenarios for ransomware detection.