運用網路封包分析與機器學習之勒索病毒偵測技術

Ransomware Detection Technique by using Network Packet Analysis and Machine Learning

蔡文淙(Wen-Tsung Tsai) ； 林韶如(Shao-Ru Lin) ； 劉得民(Te-Min Liu) ； 周兆龍(Chao-Lung Chou)

《資訊安全通訊》 28卷4期 (2022/11) Pp. 36-57

摘要

企業及政府機構遭勒索病毒攻擊的資安事件，近年來逐漸登上新聞或資安網站的版面，駭客透過駭侵手法滲透使用者電腦，甚至運用社交工程，藉由執行勒索病毒將其電腦文件檔案進行加密，受害者如急於取回文件，避免造成組織營運停滯、個人利益受損，有可能依駭客指定方法進行贖付。為減少損害，在受這類攻擊的當下，爭取應變時間就是首重目標，因此需要動態分析的方式，即時偵測出勒索病毒的攻擊。本研究基於勒索病毒在網路環境發動攻擊時所產生特殊的異常行為，提出「勒索文件封包數」與「異常封包數」兩項指標，偵測同一區網內部電腦，是否遭受勒索病毒攻擊，並運用決策樹、循序最小優化及簡單邏輯迴歸等機器學習演算法，依所提出之兩項指標數值對不同勒索病毒進行分類。經600次的實驗，實驗結果平均準確率可達99.25％以上，證明本文提出之方法可有效地偵測並分類勒索病毒。

關鍵字

勒索病毒 ； 動態分析 ； 網路封包 ； 機器學習

並列摘要

In recent years, information security incidents about enterprises and government agencies being attacked by ransomware viruses have gradually appeared on the news. Hackers penetrate users' computers through social engineering or insidious methods and encrypt their files by using ransomware viruses. Suppose the victim is eager to restore the files to avoid stagnation of the organization's operations and damage to personal interests. In that case, the ransom payment may be made according to the method specified by the hacker. To reduce damage, gaining response time is the primary goal while attacked by such attacks. Therefore, a real-time dynamic analysis method is required to detect ransomware attacks. Because of the abnormal behaviors of ransomware attacks in the network environment, this research proposes two indicators, that is, the ransom file (RF) and abnormal packets (AP), to detect whether computers are attacked by ransomware and use machine learning algorithms such as decision tree, sequential minimum optimization (SMO) and simple Logistic regression to classify different ransomware according to the two indicators. After 600 rounds of experiments, the results show an average classification accuracy rate of 99.25%, indicating that the proposed method can effectively detect and classify ransomware.

並列關鍵字

Ransomware ； Dynamic Analysis ； Packet ； Machine Learning

參考文獻

Check Point Software Technologies, https://pages.checkpoint.com/cyber-security-report-2021.html (2021/12/10).

A. Omer and S. Refik, “Investigation of possibilities to detect malware using existing tools,” IEEE/ACS 14th International Conference on Computer Systems and Applications, 2017.

VirusTotal, https://www.virustotal.com/gui/home/upload (2022/11/28).

Jotti, https://virusscan.jotti.org (2022/11/28).

Virscan, http://r.virscan.org (2022/11/28).