Source-linked AI summary
Software-Defined Networking-based Crypto Ransomware Detection Using HTTP Traffic Characteristics
Krzysztof Cabaj, Marcin Gregorczyk, Wojciech Mazurczyk
TL;DR
Ransomware, particularly crypto ransomware, threatens critical user data and motivates more effective countermeasures. The paper develops an SDN-based detector using HTTP communication characteristics from CryptoWall and Locky, and reports that the proof-of-concept is feasible, achieving a 97-98% detection rate with 1-2% false positives.
Problem
Crypto ransomware encrypts critical user data until ransom payment, creating a need for effective detection and mitigation.
Method
The paper analyzes CryptoWall and Locky traffic and builds an SDN-based detector using sequences and content sizes of HTTP POST messages.
Results
97-98% detection rate with 1-2% false positives was achieved using real ransomware samples.
Takeaways & Limitations
HTTP message sequences and corresponding sizes provide a feasible basis for SDN-based ransomware detection and rapid reaction to discovered threats.
Takeaways & Limitations
The evaluated test-bed used a Windows 7 SP1 x86_64 environment, and future work includes incorporating HTTP response sizes.
Abstract
from arXiv · showhide
Ransomware is currently the key threat for individual as well as corporate Internet users. Especially dangerous is crypto ransomware that encrypts important user data and it is only possible to recover it once a ransom has been paid. Therefore devising efficient and effective countermeasures is a rising necessity. In this paper we present a novel Software-Defined Networking (SDN) based detection approach that utilizes characteristics of ransomware communication. Based on the observation of network communication of two crypto ransomware families, namely CryptoWall and Locky we conclude that analysis of the HTTP messages' sequences and their respective content sizes is enough to detect such threats. We show feasibility of our approach by designing and evaluating the proof-of-concept SDN-based detection system. Experimental results confirm that the proposed approach is feasible and efficient.
1. Introduction
Ransomware is a growing Internet threat, with crypto ransomware encrypting critical data until victims pay. The paper proposes an SDN-based detection and mitigation system centered on communication patterns from CryptoWall and Locky.
- 1. Introduction: Ransomware generates revenue by holding victims’ machines or critical data hostage until payment is made.Its spread is amplified by improving malware products, connected devices, and crime-as-a-service tools.
- 1. Introduction: Crypto ransomware encrypts vital files, making them unusable until a ransom is paid and a decryption key is obtained.The requested ransom is typically US$300-$700, with bitcoins commonly used for payment.
- 1. Introduction: Asymmetric-key ransomware contacts a C&C server through proxy servers to request a public encryption key after infection.CryptoWall and Locky are prominent ransomware families associated with this approach.
- 1. Introduction: SDN separates control and data planes, enabling logically centralized network management for flexible security applications.This architecture provides the networking basis for the proposed detection and mitigation system.
- 1. Introduction: The paper analyzes CryptoWall and Locky traffic, designs an SDN-based detector from their behavioral similarities, and evaluates a proof-of-concept implementation.The contributions include network measurements, detection and prevention design, and implementation evaluation.
2. Related work
Prior work detects malware through network, system, or combined observations and has explored HTTP traffic, SDN, and ransomware-specific methods. The paper addresses a stated gap by using HTTP message sequences and their sizes as the main detection feature.
- 2. Related work: Existing malware detectors observe activity at the network level, system level, or both, while this paper proposes a network-level SDN solution.Related SDN work includes traffic anomaly detection and real-time mobile malware analysis.
- 2. Related work: Payload-based detection can rely on invariant plaintext or encrypted-protocol features, while HTTP studies have used URI parameters, clustering, and header order.These approaches establish HTTP traffic as a source of behavioral recognition features.
- 2. Related work: Ransomware-specific methods have monitored file-system activity, file changes, entropy, application actions, or code paths indicating locking and encryption.The reviewed systems include Heldroid, abnormal file-system monitoring, early warning, and EldeRan.
- 2. Related work: The stated novelty is using sequences of HTTP messages and their respective sizes as the main detection feature.The paper notes that prior approaches had not used this combination as their primary feature.
- 2. Related work: Earlier SDN ransomware approaches dynamically blacklist proxy servers because blocking C&C communication can prevent retrieval of the public key.The cited approaches are limited by the drawback identified in the related-work discussion.
- 2. Related work: The paper proposes detecting ransomware data exchange through network communication between an infected host and a proxy server.The approach is motivated by similar communication protocols observed in two ransomware families.
3. Crypto ransomware traffic characteristics based on CryptoWall and Locky families
CryptoWall and Locky use HTTP-based communication whose observable patterns differ in sophistication but provide traffic characteristics for ransomware analysis. Their infrastructure and protocol behavior change over time, motivating detection based on communication sequences and message sizes.
- CryptoWall communication: CryptoWall uses HTTP POST messages sent through compromised proxy servers, with encrypted communication directed to scripts on hacked web servers.CryptoWall 4.0 uses domain names and embeds its RC4 encryption key in the HTTP request.
- CryptoWall communication: CryptoWall’s exchanges include victim identification, delivery of ransom instructions and an RSA 2048-bit public key, followed by key-reception acknowledgement.CryptoWall 4.0 does not report encryption completion or the number of encrypted files, unlike CryptoWall 3.0.
- CryptoWall infrastructure: CryptoWall 3.0 infrastructure experienced proxy shutdowns, new proxy-list samples, and eventual complete infrastructure shutdown.The number of active proxy servers generally decreased over time, while CryptoWall 4.0 activity was limited during the CryptoWall 3.0 shutdown.
- Locky communication: Locky also uses HTTP POST messages but employs stronger communication encryption, so its traffic details were partly deduced rather than decrypted directly.Locky evolved from fixed message sizes to varying sizes and can use hardcoded C&C addresses followed by DGA-generated domains.
- Locky communication: Locky communication evolved through three protocol versions, including an initial version with repeated 101, 55, and 94-byte message sizes.The analyzed protocol versions used changing URLs and message characteristics across campaigns.
- Locky infrastructure: Locky distribution activity increased from typically no more than 50 daily servers before June 2016 to more than 150 during later spikes.The study also observed campaign-specific C&C infrastructure, DGA use, and changing executable or DLL entry-function details.
4. SDN-based ransomware detection based on the HTTP traffic characteristics
The method classifies ransomware-related HTTP traffic using sequences of outgoing POST-message sizes, then fine-tunes family-specific thresholds and performs SDN-based detection and blocking. Evaluation with ransomware and benign traffic produced high true-positive rates at the selected distance thresholds.
- Detection basis: The classifier uses similarities in ransomware communication and the sizes of three consecutive outgoing HTTP POST messages as its distinguishing feature.CryptoWall and Locky use similar custom communication protocols, enabling traffic classification based on POST-message content sizes.
- Detection phases: The proposed scheme has separate learning, fine-tuning, and detection phases conducted independently for each ransomware family.Learning extracts features from real samples, fine-tuning sets family-specific parameters, and detection applies them to monitored traffic.
- Learning phase: Learning represents each infection as a three-value vector containing the content sizes of its first three HTTP POST messages.These POST triples form the feature set used to establish the main distinguishing characteristic for detection.
- Detection phase: During detection, the system compares each new three-message vector with a ransomware-family centroid and flags it when the distance is below the tuned limit.The SDN-integrated preprocessing can support real-time detection, while the controller can install blocking flows for hostile C&C addresses.
- CryptoWall evaluation: For CryptoWall, a limit distance of 900 produced 98% true positives, with 4.2% false positives for POST triples and 1.2% for domains.The final detector was fine-tuned after merging the two datasets because their ROC curves were similar.
5. Conclusion
The paper presents an SDN-based ransomware detector that analyzes HTTP communication characteristics from CryptoWall and Locky. Using HTTP message sequences and sizes, the evaluated system achieved high detection rates with false-positive rates dependent on whether domains or POST triples were analyzed.
- Approach: The proposed system detects ransomware communication using HTTP message sequences and their corresponding sizes within an SDN-based architecture.The system is designed to provide rapid reaction to discovered threats.
- Evidence: Network measurements of CryptoWall and Locky showed that HTTP traffic characteristics can support ransomware detection.The evaluation used real ransomware samples and reported the approach as feasible with good efficacy.
- Results: Detection rates reached 97-98%, with false positives of 1-2% when relying on domains and 4-5% when relying on POST triples.These are the paper's reported aggregate ranges for the evaluated detection system.
- Future directions: Future work includes incorporating HTTP response sizes and combining the method with blacklists of malicious IP addresses and domains.The conclusion also emphasizes monitoring ransomware development trends and broader disruption of ransomware infrastructure.