Day 2 : Machine Learning approach for detecting Ransomware
“Wannacry is the Stuxnet of Ransomware”
―
Stuxnet is a computer virus that almost started WW3. It exploited security holes that system developers were unaware of. These holes are known as zero days. This computer virus would remian dormant without the specific target. It was looking to shut down the centrifuges that spin nuclear material at Iran's enrichment facilities.
To know more about stuxnet, find below some useful resources
1. https://www.csoonline.com/article/3218104/malware/what-is-stuxnet-who-created-it-and-how-does-it-work.html is an interesting read
2. https://youtu.be/7g0pi4J8auQ is an interesting watch
Wannacry targeted computers running the Microsoft Windows operating system by encrypting data and demanding ransom payments in the Bitcoin cryptocurrency. It took advantage of installing backdoors onto infected systems. It propagated through EternalBlue, an exploit in older Windows systems. More information about Wannacry will be detailed out in the next post.
The primary focus of this post is to understand key points from the paper cited below.
Cusack, Greg, Oliver Michel, and Eric Keller. "Machine Learning-Based Detection of Ransomware Using SDN." In Proceedings of the 2018 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization, pp. 1-6. ACM, 2018.
The recent trend has seen malware developers shift from HTTP to HTTPS to make deep packet inspection difficult, hence protecting themselves from payload inspection. So we need a solution that can leverage other features of network to identify ransomware. In order to extract features, we build a programmable forwarding engine that allows collection of per-packet, network monitoring data at high rates. Network traffic between an infected computer and the command and control (C&C) server is monitored. A stream processor is written which feeds data into random forest, a binary classifier that utilizes these rich flow records in fingerprinting malicious, network activity without the requirement of deep packet inspection.
The architecture of the system and the results obtained have been detailed out as Paper 3 in https://docs.google.com/document/d/18km6eA_VHNL9qBiHXbjvbWFOWoSMeryeXvSD3xOhabk/edit?usp=sharing
Resource to the presentation of the paper by the authors https://pdfs.semanticscholar.org/1a3d/edd9dfb77922fa680a914434e7af162dc1e5.pdf
―
Stuxnet is a computer virus that almost started WW3. It exploited security holes that system developers were unaware of. These holes are known as zero days. This computer virus would remian dormant without the specific target. It was looking to shut down the centrifuges that spin nuclear material at Iran's enrichment facilities.
To know more about stuxnet, find below some useful resources
1. https://www.csoonline.com/article/3218104/malware/what-is-stuxnet-who-created-it-and-how-does-it-work.html is an interesting read
2. https://youtu.be/7g0pi4J8auQ is an interesting watch
Wannacry targeted computers running the Microsoft Windows operating system by encrypting data and demanding ransom payments in the Bitcoin cryptocurrency. It took advantage of installing backdoors onto infected systems. It propagated through EternalBlue, an exploit in older Windows systems. More information about Wannacry will be detailed out in the next post.
The primary focus of this post is to understand key points from the paper cited below.
Cusack, Greg, Oliver Michel, and Eric Keller. "Machine Learning-Based Detection of Ransomware Using SDN." In Proceedings of the 2018 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization, pp. 1-6. ACM, 2018.
The recent trend has seen malware developers shift from HTTP to HTTPS to make deep packet inspection difficult, hence protecting themselves from payload inspection. So we need a solution that can leverage other features of network to identify ransomware. In order to extract features, we build a programmable forwarding engine that allows collection of per-packet, network monitoring data at high rates. Network traffic between an infected computer and the command and control (C&C) server is monitored. A stream processor is written which feeds data into random forest, a binary classifier that utilizes these rich flow records in fingerprinting malicious, network activity without the requirement of deep packet inspection.
The architecture of the system and the results obtained have been detailed out as Paper 3 in https://docs.google.com/document/d/18km6eA_VHNL9qBiHXbjvbWFOWoSMeryeXvSD3xOhabk/edit?usp=sharing
Resource to the presentation of the paper by the authors https://pdfs.semanticscholar.org/1a3d/edd9dfb77922fa680a914434e7af162dc1e5.pdf
It is also possible that some systems may still access things even though SSL certificate mismatch occurs. Would you like to consider terminating the HTTPS Connection, present a different certificate (which will have name mismatch) assuming client continues with name mismatch and still carry out DPI
ReplyDelete