Publication: Crypto-ransomware detection using machine learning models in file-sharing network scenarios with encrypted traffic
| dc.contributor.author | Berrueta Irigoyen, Eduardo | |
| dc.contributor.author | Morató Osés, Daniel | |
| dc.contributor.author | Magaña Lizarrondo, Eduardo | |
| dc.contributor.author | Izal Azcárate, Mikel | |
| dc.contributor.department | Ingeniería Eléctrica, Electrónica y de Comunicación | es_ES |
| dc.contributor.department | Ingeniaritza Elektrikoa, Elektronikoaren eta Telekomunikazio Ingeniaritzaren | eu |
| dc.contributor.funder | Universidad Pública de Navarra / Nafarroako Unibertsitate Publikoa | es |
| dc.date.accessioned | 2023-01-30T09:09:01Z | |
| dc.date.available | 2023-01-30T09:09:01Z | |
| dc.date.issued | 2022 | |
| dc.date.updated | 2023-01-30T08:44:55Z | |
| dc.description.abstract | Ransomware is considered as a significant threat for home users and enterprises. In corporate scenarios, users’ computers usually store only system and program files, while all the documents are accessed from shared servers. In these scenarios, one crypto-ransomware infected host is capable of locking the access to all shared files it has access to, which can be the whole set of files from a workgroup of users. We propose a tool to detect and block crypto-ransomware activity based on file-sharing traffic analysis. The tool monitors the traffic exchanged between the clients and the file servers and using machine learning techniques it searches for patterns in the traffic that betray ransomware actions while reading and overwriting files. This is the first proposal designed to work not only for clear text protocols but also for encrypted file-sharing protocols. We extract features from network traffic that describe the activity opening, closing, and modifying files. The features allow the differentiation between ransomware activity and high activity from benign applications. We train and test the detection model using a large set of more than 70 ransomware binaries from 33 different strains and more than 2,400 h of ‘not infected’ traffic from real users. The results reveal that the proposed tool can detect all ransomware binaries described, including those not used in the training phase. This paper provides a validation of the algorithm by studying the false positive rate and the amount of information from user files that the ransomware could encrypt before being detected | en |
| dc.description.sponsorship | This work was supported by Spanish Ministry of Science and Innovation through project PID2019-104451RB-C22/AEI/10.13039/ 501100011033. Open access funding provided by Universidad Pública de Navarra. | en |
| dc.format.mimetype | application/pdf | en |
| dc.identifier.citation | Berrueta, E., Morato, D., Magaña, E., & Izal, M. (2022). Crypto-ransomware detection using machine learning models in file-sharing network scenarios with encrypted traffic. Expert Systems with Applications, 209, 118299. https://doi.org/10.1016/j.eswa.2022.118299 | en |
| dc.identifier.doi | 10.1016/j.eswa.2022.118299 | |
| dc.identifier.issn | 0957-4174 | |
| dc.identifier.uri | https://academica-e.unavarra.es/handle/2454/44627 | |
| dc.language.iso | eng | en |
| dc.publisher | Elsevier | en |
| dc.relation.ispartof | Expert Systems with Applications 209 (2022) 118299 | en |
| dc.relation.projectID | info:eu-repo/grantAgreement/AEI/Plan Estatal de Investigación Científica y Técnica y de Innovación 2017-2020/PID2019-104451RB-C22/ES/ | en |
| dc.relation.publisherversion | https://doi.org/10.1016/j.eswa.2022.118299 | |
| dc.rights | © 2022 The Author(s). This is an open access article under the CC BY license | en |
| dc.rights.accessRights | Acceso abierto / Sarbide irekia | es |
| dc.rights.accessRights | info:eu-repo/semantics/openAccess | en |
| dc.rights.uri | http://creativecommons.org/licenses/by/4.0/ | |
| dc.subject | Crypto-ransomware | en |
| dc.subject | File-sharing traffic | en |
| dc.subject | Network security | en |
| dc.title | Crypto-ransomware detection using machine learning models in file-sharing network scenarios with encrypted traffic | en |
| dc.type | Artículo / Artikulua | es |
| dc.type | info:eu-repo/semantics/article | en |
| dc.type.version | Versión publicada / Argitaratu den bertsioa | es |
| dc.type.version | info:eu-repo/semantics/publishedVersion | en |
| dspace.entity.type | Publication | |
| relation.isAuthorOfPublication | 66d6a070-df96-4f8b-ba63-cb0a93f576ce | |
| relation.isAuthorOfPublication | cd454059-725e-480a-b896-894e79f307a5 | |
| relation.isAuthorOfPublication | c521bf55-a1e7-47b2-ac98-5fbf8c286f7a | |
| relation.isAuthorOfPublication | f829a159-0938-45d1-a352-d28fb297ed0b | |
| relation.isAuthorOfPublication.latestForDiscovery | 66d6a070-df96-4f8b-ba63-cb0a93f576ce |