Software-Defined Networking-based Crypto Ransomware Detection Using HTTP Traffic Characteristics

摘要

Ransomware is currently the key threat for individual as well as corporateInternet users. Especially dangerous is crypto ransomware that encryptsimportant user data and it is only possible to recover it once a ransom hasbeen paid. Therefore devising efficient and effective countermeasures is arising necessity. In this paper we present a novel Software-Defined Networking(SDN) based detection approach that utilizes characteristics of ransomwarecommunication. Based on the observation of network communication of two cryptoransomware families, namely CryptoWall and Locky we conclude that analysis ofthe HTTP messages' sequences and their respective content sizes is enough todetect such threats. We show feasibility of our approach by designing andevaluating the proof-of-concept SDN-based detection system. Experimentalresults confirm that the proposed approach is feasible and efficient.