Person:
Berrueta Irigoyen, Eduardo

Profile Picture

Email Address

person.page.identifierURI

https://academica-e.unavarra.es/handle/2454/48721

Birth Date

Research Projects

Organizational Units

Job Title

Last Name

Berrueta Irigoyen

First Name

Eduardo

person.page.departamento

Ingeniería Eléctrica, Electrónica y de Comunicación

person.page.instituteName

ORCID

0000-0002-0076-4479

person.page.upna

811478

Name

Filters

20221
Reset filters

Settings

Author: Izal Azcárate, Mikel × Author: Berrueta Irigoyen, Eduardo × Start date: 2020 × End date: 2022 × Subject: Network security ×

Search Results

Now showing 1 - 1 of 1
  • Thumbnail Image
    PublicationOpen Access
    Crypto-ransomware detection using machine learning models in file-sharing network scenarios with encrypted traffic
    (Elsevier, 2022) Berrueta Irigoyen, Eduardo; Morató Osés, Daniel; Magaña Lizarrondo, Eduardo; Izal Azcárate, Mikel; Ingeniería Eléctrica, Electrónica y de Comunicación; Ingeniaritza Elektrikoa, Elektronikoaren eta Telekomunikazio Ingeniaritzaren; Universidad Pública de Navarra / Nafarroako Unibertsitate Publikoa
    Ransomware is considered as a significant threat for home users and enterprises. In corporate scenarios, users’ computers usually store only system and program files, while all the documents are accessed from shared servers. In these scenarios, one crypto-ransomware infected host is capable of locking the access to all shared files it has access to, which can be the whole set of files from a workgroup of users. We propose a tool to detect and block crypto-ransomware activity based on file-sharing traffic analysis. The tool monitors the traffic exchanged between the clients and the file servers and using machine learning techniques it searches for patterns in the traffic that betray ransomware actions while reading and overwriting files. This is the first proposal designed to work not only for clear text protocols but also for encrypted file-sharing protocols. We extract features from network traffic that describe the activity opening, closing, and modifying files. The features allow the differentiation between ransomware activity and high activity from benign applications. We train and test the detection model using a large set of more than 70 ransomware binaries from 33 different strains and more than 2,400 h of ‘not infected’ traffic from real users. The results reveal that the proposed tool can detect all ransomware binaries described, including those not used in the training phase. This paper provides a validation of the algorithm by studying the false positive rate and the amount of information from user files that the ransomware could encrypt before being detected