Source-linked AI summary
Leveraging Machine Learning Techniques for Windows Ransomware Network Traffic Detection
Omar M. K. Alhawi, James Baldwin, Ali Dehghantanha
TL;DR
Windows ransomware detection remains important as ransomware expands and variants evade existing dynamic machine-learning detection. NetConverse analyses conversation-based network traffic features with multiple classifiers and achieves a 97.1% true positive rate using J48.
Problem
Ransomware is a significant threat, and evolving variants are developed to evade existing dynamic machine-learning detection.
Method
NetConverse extracts conversation-based network traffic features from Windows ransomware and benign applications and evaluates multiple classifiers.
Results
97.1% TPR was achieved using the Decision Tree (J48) classifier, which achieved the highest reported performance across five metrics and 97.10% accuracy.
Takeaways & Limitations
NetConverse identified J48 as the best classifier for detecting Windows ransomware from network traffic conversation data.
Abstract
from arXiv · showhide
Ransomware has become a significant global threat with the ransomware-as-a-service model enabling easy availability and deployment, and the potential for high revenues creating a viable criminal business model. Individuals, private companies or public service providers e.g. healthcare or utilities companies can all become victims of ransomware attacks and consequently suffer severe disruption and financial loss. Although machine learning algorithms are already being used to detect ransomware, variants are being developed to specifically evade detection when using dynamic machine learning techniques. In this paper, we introduce NetConverse, a machine learning analysis of Windows ransomware network traffic to achieve a high, consistent detection rate. Using a dataset created from conversation-based network traffic features we achieved a true positive detection rate of 97.1% using the Decision Tree (J48) classifier.
1. Introduction
Ransomware’s growing criminal scale and evolving evasion tactics motivate machine-learning detection research. The paper evaluates classifiers on ransomware and goodware network traffic using extracted features.
- Ransomware-as-a-service expanded access to ransomware creation kits and distribution for users with little technical knowledge.
- The evaluation analysed network traffic from 9 ransomware families, 210 samples, and 264 goodware samples.
- The study evaluated 6 machine-learning classifiers and extracted 13 traffic features from ransomware samples.
- The paper is structured around related work, methodology, experiments and results, and conclusions with future work.
2. Related Works
Prior malware-detection research uses machine learning with behavioural features, while malware authors increasingly employ propagation and evasion techniques.
- Machine-learning techniques have been used for malware detection and analysis for decades.
- Malware classification with machine learning has been successful for Android malware detection.
- Malware detection studies use API calls, filesystem changes, and network traffic as behavioural features.
- Malicious programs increasingly use propagation and evasion techniques to bypass defensive mechanisms.
3. Methodology
NetConverse collects malicious and benign Windows network traffic, converts captures into conversation-based features, and evaluates six classifiers to identify an optimum detection model.
- The methodology comprises data collection, feature extraction, and machine-learning classifier phases.
- 3.1 Data collection phase: The dataset contains 210 ransomware captures from 9 families and 264 benign samples collected through Virus Total Intelligence.
- 3.2 Feature selection and extraction: TShark aggregates captures into unique conversations using protocol, endpoint addresses, ports, and corresponding statistical values.
- 3.2 Feature selection and extraction: Preprocessing removes invalid, DNS, and selected temporal or volume attributes, leaving 9 features and converting IP addresses to decimal values.
- Manual splitting produced 75,618 training instances and 48,526 test instances while balancing malware and goodware samples.
- 3.3 Machine Learning classifiers: Six classifiers, including J48, KNN, LMT, Random Forest, Multilayer Perceptron, and Bayes Network, were evaluated with default settings.
7 4. Experiments and Results
The experiments compare six classifiers across cross-validation and held-out testing with and without feature selection. J48 provides the strongest reported detection performance, while feature selection generally reduces processing time without materially changing results.
- The experiment used 10-fold cross-validation with 10 or 8 attributes and re-evaluated each classifier on a supplied test dataset.
- 4.2 Latest malware experiment and results: Feature selection decreased model-building time for Bayes Network, Multilayer Perceptron, J48, and Random Forest, but increased it for KNN and LMT.
- 4.2 Latest malware experiment and results: Feature selection slightly reduced Random Forest performance, increased Bayes Network and Multilayer Perceptron TPR by 0.10% and 0.30%, and left KNN and LMT unchanged.
- 4.2 Latest malware experiment and results: 97.10% accuracy and 1.60% FPR made J48 the best classifier across TPR, FPR, precision, recall, and F-measure.
- 4.2 Latest malware experiment and results: NetConverse achieved a 97.1% TPR with J48, compared with 96.3% for a dynamic-analysis Windows ransomware study and 95.0% for a botnet study.
5. Conclusion and Future Works
NetConverse evaluates multiple machine learning classifiers for detecting Windows ransomware from network traffic conversations, identifying Decision Tree (J48) as the strongest classifier by true positive rate.
- 97.1% detection rate accuracy was achieved with the Decision Tree (J48) classifier, compared with 96.8% for the Logistic Model Tree classifier.
- NetConverse evaluated Bayes network, Decision Tree, K-Nearest Neighbours, Multi-Layer Perceptron, Random Forest, and Logistic Model Tree classifiers.
- The model analysed network traffic conversation data using extracted features and identified the best classifier based on true positive rate.
- The dataset-collection method filtered network conversations to remove duplication and non-relevant attributes before training.
- The study presents its machine-learning classifier results as a baseline for future research.