论文标题
使用机器学习模型在文件共享网络方案中使用机器学习模型检测，并具有加密流量
Crypto-ransomware detection using machine learning models in file-sharing network scenario with encrypted traffic
论文作者
论文摘要
自过去几年以来，勒索软件被认为是大多数企业的重要威胁。在用户可以访问共享服务器上所有文件的方案中，一个受感染的主机可以锁定所有共享文件的访问。我们提出了一种基于文件共享流量分析的工具来检测勒索软件感染。该工具可以监视客户端和文件服务器之间交换的流量，并使用机器学习技术搜索流量中的模式，这些模式在阅读和覆盖文件时背叛了勒索软件操作。该建议旨在用于清晰文本和加密文件共享协议。我们比较三种机器学习模型，并选择最佳验证。我们使用来自26种不同应变的70多个勒索软件二进制文件训练和测试检测模型，而实际用户未感染的流量超过2500小时。结果表明，所提出的工具可以检测所有勒索软件二进制文件，包括在训练阶段未使用的索赔二进制文件（看不见）。本文通过研究违规软件可能加密的误报率和从检测到的用户文件中的信息量来验证算法。
Ransomware is considered as a significant threat for most enterprises since the past few years. In scenarios wherein users can access all files on a shared server, one infected host can lock the access to all shared files. We propose a tool to detect ransomware infection based on file-sharing traffic analysis. The tool monitors the traffic exchanged between the clients and the file servers and using machine learning techniques it searches for patterns in the traffic that betray ransomware actions while reading and overwriting files. The proposal is designed to work for clear text and for encrypted file-sharing protocols. We compare three machine learning models and choose the best for validation. We train and test the detection model using more than 70 ransomware binaries from 26 different strains and more than 2500 hours of not infected traffic from real users. The results reveal that the proposed tool can detect all ransomware binaries, including those not used in training phase (unseen). This paper provides a validation of the algorithm by studying the false positive rate and the amount of information from user files that the ransomware could encrypt before being detected.
