Toward A Network-Assisted Approach for Effective Ransomware Detection
This work addresses the problem of ransomware detection for enterprises and individuals, offering an incremental improvement with network-level mechanisms.
The paper tackles ransomware detection by proposing a Network-Assisted Approach (NAA) with local and network-level mechanisms, achieving applicability in both WAN and LAN environments as demonstrated through experiments using 100 Docker containers and a hybrid ransomware sample.
Ransomware is a kind of malware using cryptographic mechanisms to prevent victims from normal use of their computers. As a result, victims lose the access to their files and desktops unless they pay the ransom to the attackers. By the end of 2019, ransomware attack had caused more than 10 billion dollars of financial loss to enterprises and individuals. In this work, we propose Network-Assisted Approach (NAA), which contains effective local detection and network-level detection mechanisms, to help users determine whether a machine has been infected by ransomware. To evaluate its performance, we built 100 containers in Docker to simulate network scenarios. A hybrid ransomware sample which is close to real-world ransomware is deployed on stimulative infected machines. The experiment results show that our network-level detection mechanisms are separately applicable to WAN and LAN environments for ransomware detection.