Ransomware Network Traffic Analysis for Pre-Encryption Alert

Routa Moussaileb (1) , Nora Cuppens (2, 1) , Jean-Louis Lanet (3, 4) , Hélène Le Bouder (1, 5)

1 IMT Atlantique - SRCD - Département Systèmes Réseaux, Cybersécurité et Droit du numérique
2 Lab-STICC - Laboratoire des sciences et techniques de l'information, de la communication et de la connaissance
3 CIDRE - Confidentialité, Intégrité, Disponibilité et Répartition
4 LHS - Inria - Laboratoire de Haute Sécurité
5 OCIF - Objets communicants pour l'Internet du futur

Cyber Security researchers are in an ongoing battle against ransomware attacks. Some exploits begin with social engineering methods to install payloads on victims' computers , followed by a communication with command and control servers for data exchange. To scale down these attacks, scientists should shed light on the danger of those rising intrusions to prevent permanent data loss. To join this arm race against malware, we propose in this paper an analysis of various ransomware families based on the collected system and network logs from a computer. We delve into malicious network traffic generated by these samples to perform a packet level detection. Our goal is to reconstruct ransomware's full activity to check if its network communication is distinguishable from benign traffic. Then, we examine if the first packet sent occurs before data's encryption to alert the administrators or afterwards. We aim to define the first occurrence of the alert raised by malicious network traffic and where it takes place in a ransomware workflow. Logs collected are available at http://serveur2.seres.rennes.telecom-bretagne.eu/data/RansomwareData/.

Domaines: Cryptographie et sécurité [cs.CR]

Routa Moussaileb, Nora Cuppens, Jean-Louis Lanet, Hélène Le Bouder. Ransomware Network Traffic Analysis for Pre-Encryption Alert. FPS 2019: 12th International Symposium on Foundations & Practice of Security, Nov 2019, Toulouse, France. ⟨10.1007/978-3-030-45371-8_2⟩. ⟨hal-02313656⟩