.png){kind=icon}
.png){kind=icon}
Return
Software-defined networking-based crypto ransomware detection using HTTP traffic characteristics
.png){kind=icon}
OA
AI
DOI：10.1016/j.compeleceng.2017.10.012.png)
.png){kind=icon}
.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Ransomware is currently one of the key threats facing individuals and corporate Internet users. Especially dangerous is crypto ransomware that encrypts important user data, and it is only possible to recover it once a ransom has been paid. Therefore, devising efficient and effective countermeasures is a pressing necessity. In this paper we present a novel Software-Defined Networking (SDN) based detection approach that utilizes the characteristics of the ransomware communication. Based on an observation of network communication between two crypto ransomware families, namely CryptoWall and Locky, we conclude that an analysis of the HT'? message sequences and their respective content sizes is enough to detect such threats. We show the feasibility of our approach by designing and evaluating a proof-of-concept SDN-based detection system. The experimental results confirm that the proposed approach is feasible and efficient. (C) 2017 Elsevier Ltd. All rights reserved.
Keywords:
Ransomware
Malware
Software-defined networking
Network security
AI Summary
Key information extracted from the uploaded paper, including a brief overview, abstract, background, key highlights, visual analysis, and future outlook.
Journal
C
IF:
4.9
Papers:
6.7K
Citations:
1.3W