main.texRead-only preview
\documentclass[12pt,letterpaper]{article}
% Typography
\usepackage{fontspec}
\usepackage{ebgaramond}
% Section and Subsection Formatting
\usepackage{titlesec}
\titleformat{\section}
{\normalfont\fontsize{18}{15}\selectfont\bfseries}
{\thesection}{6 pt}{}
\titleformat{\subsection}
{\normalfont\fontsize{14}{13}\itshape\mdseries}
{\thesubsection}{8 pt}{}
% Fonts
\newfontfamily\englishtowne{EnglishTowne}[
Path = fonts/,
Extension = .ttf,
]
\newfontfamily\anglican{AnglicanText-Regular}[
Path = fonts/,
Extension = .ttf,
]
% Page Layout
\usepackage{geometry}
\geometry{margin= 2cm} % Adjust as needed
% Graphics
\usepackage{graphicx}
% Text Formatting
\usepackage{parskip}
\usepackage{lipsum} % For generating dummy text
\usepackage[english]{babel}
\usepackage{soul}
% Colors
\usepackage{xcolor}
\definecolor{codegreen}{rgb}{0,0.6,0}
\definecolor{codegray}{rgb}{0.5,0.5,0.5}
\definecolor{codepurple}{rgb}{0.58,0,0.82}
\definecolor{backcolour}{rgb}{0.95,0.95,0.92}
\definecolor{tudelftdarkblue}{RGB}{12,35,64}
\definecolor{tudelftcyan}{RGB}{0,166,214}
\definecolor{tudelftblue}{RGB}{0,118,194}
\definecolor{tyrianpurple}{RGB}{95, 34, 68}
\definecolor{carlet}{RGB}{104, 22, 45}
\definecolor{indigoDye}{RGB}{8, 71, 120}
\definecolor{Denim}{RGB}{8, 93, 191}
\definecolor{faded-blue}{RGB}{78, 119, 166}
\definecolor{bluish-denim}{RGB}{5, 147, 255}
% Hyperlinks
\usepackage{hyperref}
\hypersetup{
colorlinks=true, % Use color for links
linkcolor=faded-blue, % Set link color
urlcolor=Denim, % Set URL color
citecolor=bluish-denim, % Set citation color
}
% Headers and Footers
\usepackage{fancyhdr}
\pagestyle{fancy}
\fancyhf{} % Clear header and footer
\renewcommand{\headrulewidth}{0pt} % Remove header line
\renewcommand{\footrulewidth}{0.5pt} % Add footer line
\fancyfoot[C]{\thepage} % Page number in the center of the footer
% Code Listings
\usepackage{listings}
\lstdefinestyle{mystyle}{
backgroundcolor=\color{backcolour},
commentstyle=\color{codegreen},
keywordstyle=\color{magenta},
numberstyle=\tiny\color{codegray},
stringstyle=\color{codepurple},
basicstyle=\ttfamily\small,
breakatwhitespace=false,
breaklines=true,
captionpos=b,
keepspaces=true,
% numbers=left,
% numbersep=2.5pt,
showspaces=false,
showstringspaces=false,
showtabs=true,
tabsize=1
}
\lstset{style=mystyle}
% Algorithms
\usepackage{algpseudocode}
\usepackage{algorithm}
% Mathematics
\usepackage{amsmath}
% Loops
\usepackage{forloop}
% Tables
\usepackage{booktabs}
% Bibliography
\usepackage[style=ieee, backend=biber]{biblatex}
\addbibresource{reference.bib}
% Enumeration
\usepackage{enumitem}
% TikZ
\usepackage{tikz}
\usepackage{tikzpagenodes}
% Quoting
\usepackage{csquotes}
% Line spacing
\linespread{1.25}
%Heading Settings
\usepackage{titlesec}
\titleformat{\subsection}
{\normalfont\fontsize{16}{18}\bfseries}{\thesubsection}{1em}{}
%indentations
% \usepackage{tocloft}
%abbreviation List
\usepackage{acronym}
%table Lining
\usepackage{hhline}
\begin{document}
% Title page Header
\begin{titlepage}
\begin{center}
\textbf{\LARGE Ransomware Detection Application} \\ \LARGE Application of \textbf{Deep Packet Inspection} based on \textbf{SDN} \\
\large {\textbf{A REPORT} \\ \textit{Submitted in partial fulfillment of the requirements for the award of the degree \\ of}
\\ \textbf{Bachelor of Technology} \\ \textit{in} \\ \textbf{COMPUTER SCIENCE AND ENGINEERING}} \\
\Large by
\textbf{\Large Hemant Kumar} \\
(Roll No. 20BCS100)
\vspace{0.8cm}
\Large Supervisor:
\textbf{\Large Dr. Neelam Dayal }\\
(Assistant Professor) \\ CSE, IIITDM Jabalpur
\vspace{0.8cm}
% External Supervisor(s):
% Name of External Supervisor \\
% Company/Institute Address
\vfill
% Institute emblem
\includegraphics[width=30mm]{images/logo_college copy.png}
\vspace{0.5cm}
\Large{Computer Science and Engineering
\\ PDPM Indian Institute of Information Technology, Design and Manufacturing, Jabalpur}
\\ (2024)
\end{center}
\end{titlepage}
\pagenumbering{Roman}
\newpage
\begin{center}
\phantomsection % Create a phantom section for accurate hyperlinking
\addcontentsline{toc}{section}{APPROVAL SHEET}
\vspace*{1cm}
\LARGE APPROVAL SHEET
\vspace{1.2cm}
% Your acknowledgment paragraph goes here
\large The thesis/ report entitled \textbf{"Ransomware Detection Application"} submitted By \textbf{Hemant Kumar}(Roll No. 20BCS100) is approved for the partial fulfillment of the requirements for the degree of \textbf{Bachelor of Technology} in \textbf{Computer Science and Engineering}.
% Add any additional acknowledgments here
\vfill
\noindent
\begin{tabular}{@{}ll@{}}
Date: & \underline{\hspace{4cm}} \\
Place: & Jabalpur \\ \end{tabular}
\hfill
\vspace{0.6cm} % Vertical space between Date/Place and Guide
\hfill
\begin{tabular}{@{}ll@{}}
\multicolumn{2}{@{}l}{\hspace{20pt} Guide} \\
& \underline{\hspace{4cm}} \\
& \underline{\hspace{4cm}} \\
& \underline{\hspace{4cm}}
\end{tabular}%
\vspace*{4 cm}
\end{center}
\newpage
\begin{center}
\phantomsection % Create a phantom section for accurate hyperlinking
\addcontentsline{toc}{section}{DECLARATION}
\vspace*{1cm}
\LARGE DECLARATION
\vspace{1.2cm}
\large I hereby declare that the submitted report is my own work, and the work done by the undersigned has not been submitted anywhere for the award of any other degree or diploma in any university or other Institutes of higher learning. All the sources of the information used in the current work have been duly acknowledged.
\vfill
\hfill {Hemant Kumar \\
\hfill \begin{tabular}{@{}l l@{}} Date: & \underline{\hspace{4cm}} \end{tabular}}
\vspace*{2 cm}
\end{center}
\newpage
\begin{center}
\vspace*{1cm}
\phantomsection % Create a phantom section for accurate hyperlinking
\addcontentsline{toc}{section}{Certificate}
{\englishtowne \LARGE Certificate}
\vspace{1.2cm}
% Your acknowledgment paragraph goes here
\large This is to certify that the Report entitled, \textbf{"Ransomeware Detection Application"}, submitted by \textbf{Hemant Kumar, Roll No. 20BCS100} in partial fulfillment of the requirements for the award of \textbf{ B.Tech Degree in Computer Science and Engineering}, at PDPM Indian Institute of Information Technology, Design and Manufacturing Jabalpur is an authentic work carried out by him under my supervision and guidance.
To the best of my knowledge, the matter embodied in the thesis has not been submitted elsewhere to any other university/institute for the award of any other degree.
% Add any additional acknowledgments here
\vfill % Adjust the vertical space as needed
\noindent
\begin{tabular}{@{}ll@{}}
\textbf{Dr. Neelam Dayal} & \hfill\textbf{{{\today}}} \\
\large Assistant Professor & \\
\parbox[t]{0.7\textwidth}{%
Computer Science and Engineering Discipline, \\
PDPM Indian Institute of Information Technology, Design and Manufacturing, Jabalpur, M.P, India-482005
}
\end{tabular}
\vspace{2cm}
\end{center}
\newpage
\begin{center}
\phantomsection % Create a phantom section for accurate hyperlinking
\addcontentsline{toc}{section}{Acknowledgement}
\vspace*{1cm}
{\englishtowne \LARGE Acknowledgement}
\vspace{1.2cm}
% Your acknowledgment paragraph goes here
\large I would like to express my sincere gratitude to all the people who contributed in some way to the work described in this Project. Primarily I thanks to my respected supervisor, \textbf{Dr. Neelam Dayal}, Assistant Professor in Computer Science and Engineering department, during my tenure of \textbf{BTP}, she contributed to an enriching college experience by giving me intellectual freedom in my work, providing me inspiration and motivation, engaging me with new ideas, and demanding a high quality of work in all my endeavors. It was a matter of great felicity and privilege for me to work under her auspices.
Additionally, I would like to thanks \textbf{Dr. Abhishek Verma} (Assistant Professor), I.T Deptt. from the \textbf{Babasaheb Bhimrao Ambedkar University, Lucknow} for their interest in my work, for extending their valuable time and support throughout my Project.
I owe special thanks to my Project Partner \textbf{Chaitanya Mandi, Roll-no: 20BCS062} for his support and suggestions that kept me motivated to accomplish my research work during my course duration. I would like to thanks my all seniors, of the Computer Science and Engineering Department including the non-teaching staff with whom I got the opportunity to work in a healthy and joyful environment.
Finally, I would like to acknowledge my beloved family members who supported me during my time here. I am really obliged for their constant love and support.
% Add any additional acknowledgments here
\vfill % Adjust the vertical space as needed
\hrule % Add a horizontal line
\vspace{1cm} % Adjust the vertical space after the line
% Your name on the right-align
\hfill \textbf{Hemant Kumar}
% \vfill % Fill the remaining vertical space
% Institute emblem (if needed)
\end{center}
\newpage
\begin{center}
\phantomsection % Create a phantom section for accurate hyperlinking
\addcontentsline{toc}{section}{Abstract}
\vspace*{1cm}
\hrule
\begin{abstract}
\hrule
\vspace*{0.5 cm}
\textbf{Background:} Ransomware poses a severe threat to the security of digital assets, with a rising frequency of sophisticated attacks targeting individuals and organizations globally. The potential for significant financial and reputational damage underscores the urgent need for robust and proactive countermeasures. Traditional antivirus solutions often fall short in detecting evolving ransomware variants, necessitating the development of advanced detection applications.
\textbf{Aim:} The primary objective of this research is to design, implement, and evaluate a cutting-edge Ransomware Detection Application. Leveraging innovative techniques, including machine learning and behavioral analysis, our application aims to provide real-time detection and mitigation of ransomware threats. By enhancing the resilience of systems against emerging attack vectors, the goal is to fortify the cybersecurity posture of individuals and organizations in the face of evolving ransomware landscape.
\textbf{Conclusion:} The developed Ransomware Detection Application showcases promising results in effectively identifying and neutralizing ransomware threats. Through extensive testing and validation, our application demonstrates a high level of accuracy and efficiency in differentiating normal user behavior from malicious activities associated with ransomware attacks. The successful deployment of this solution contributes significantly to the ongoing efforts to secure digital environments against the menace of ransomware.
\vspace*{0.5 cm}
\hrule
\vspace*{0.5 cm}
\textbf{Keywords:} Ransomware, Detection Application, Cybersecurity, Machine Learning, Behavioral Analysis, Threat Mitigation, Real-time Protection, Cyber Threats, Digital Security, Antivirus Solutions, Deep Packet inspection, Worm Component, Shallow Packet Inspection, Regular expression, Signature Based Detection, Anomaly Based Detection.
\end{abstract}
\hrule
\vspace{1.2cm}
\end{center}
\newpage
\renewcommand{\listfigurename}{}
\renewcommand{\listtablename}{}
\begin{center}
\phantomsection % Create a phantom section for accurate hyperlinking
\addcontentsline{toc}{section}{Lists of Figures and Tables}
\Large {Lists of Figures}
\listoffigures
\Large {Lists of Tables}
\listoftables
\vspace{1.2cm}
\end{center}
\newpage
\begin{center}
\phantomsection % Create a phantom section for accurate hyperlinking
\addcontentsline{toc}{section}{List of Abbreviation}
\vspace*{1cm}
\Large{List of Abbreviation}
\input{acronymsList}
\vspace{1.2cm}
\end{center}
\newpage
\begin{center}
\phantomsection
\addcontentsline{toc}{section}{Table of Content}
\tableofcontents
\newpage
\clearpage
\end{center}
\newpage
\phantomsection
% \pagenumbering{arabic}
\section*{Chapter 1}
\addcontentsline{toc}{section}{Chapter 1}
\vspace*{1.2 cm}
\section{Introduction}
In an era dominated by digital connectivity, the persistent threat of ransomware looms large, posing a formidable challenge to the security of individuals and organizations alike. Ransomware, a malicious software that encrypts or locks files and demands a ransom for their release, has evolved into a sophisticated and dynamic cyber threat. Understanding the nuances of ransomware is pivotal in developing effective countermeasures to safeguard against its pernicious impacts.\cite{AKBANOV2019111}
Ransomware, at its core, is a form of cyber extortion wherein malicious actors leverage advanced encryption algorithms to restrict access to files or entire systems. The victim, often left with no recourse, is coerced into paying a ransom, typically in cryptocurrency, to obtain the decryption key. This nefarious practice has given rise to various types of ransomware, each exhibiting distinct characteristics and complexities.
\textbf{\textit{Encrypting Ransomware:}} This variant employs robust encryption algorithms, rendering files inaccessible until a ransom is paid. Notable examples include CryptoLocker and WannaCry.
\textbf{\textit{Locker Ransomware:}} Instead of encrypting files, locker ransomware locks users out of their systems, demanding payment for access restoration. Instances like the FBI virus and Winlocker fall into this category.
\textbf{\textit{Scareware:}} While not encrypting files, scareware falsely claims the presence of malware, tricking users into paying for non-existent security solutions.
\textbf{\textit{Mobile Ransomware:}} Targeting mobile devices, this variant demands payment for decrypting files or unlocking the device. Svpeng and Android Defender are prominent examples.
\textbf{\textit{Doxware/Leakware:}} This type of ransomware not only encrypts files but also threatens to release sensitive information to the public if the ransom is not paid. It adds a layer of extortion by leveraging the fear of data exposure.
\vspace{5mm}
Ransomware operates in distinct stages. Initially, it gains access to systems through various means, including phishing emails, compromised websites, or exploiting software vulnerabilities. Once inside, it swiftly encrypts the victim's files using robust algorithms, making them inaccessible without a unique decryption key held by the attacker.
Following encryption, a ransom note appears, typically demanding payment in cryptocurrencies like Bitcoin or Ethereum. This note outlines instructions for payment and promises the release of the decryption key upon receipt. However, there's no guarantee that paying the ransom will result in the safe return of files. In some cases, victims receive decryption keys, but they may be faulty or lead to further issues.
Ransomware attacks carry severe consequences, including substantial financial losses, compromising sensitive data, and disrupting business operations. These incidents underscore the critical importance of robust cybersecurity measures to mitigate risks and protect against such threats.
\subsection{Motivation and Problem Statement}
The proliferation of ransomware attacks in recent years has posed a significant threat to individuals, businesses, and organizations worldwide. Ransomware, a type of malicious software designed to encrypt files or restrict access to a computer system until a ransom is paid, has become increasingly sophisticated and difficult to detect. Traditional security measures often struggle to keep pace with the evolving tactics and techniques employed by ransomware operators.
The devastating impact of ransomware attacks, such as the infamous WannaCry incident, underscores the urgent need for innovative approaches to detect and mitigate these threats effectively. Conventional security solutions, while essential, are often reactive and struggle to provide timely protection against emerging ransomware variants.
In response to this pressing need, our research focuses on the development of a proactive ransomware detection and mitigation solution using \ac{SDN} technology. By leveraging the programmability and centralized control capabilities of SDN, we aim to enhance the resilience of network infrastructures against ransomware attacks and minimize the potential damage caused by such incidents.
Despite the availability of traditional security measures, ransomware attacks continue to pose a significant threat to organizations worldwide. Existing security solutions often rely on signature-based detection methods and struggle to detect ransomware variants with previously unseen characteristics. Moreover, the rapid propagation and encryption capabilities of modern ransomware strains, exemplified by WannaCry, exacerbate the challenge of timely detection and containment.
Our research seeks to address the following key challenges:
\begin{enumerate}
\item Detection Accuracy
\item Real-Time Mitigation
\item Scalablity and Adaptablity
\end{enumerate}
\subsection{About Ransomware and its functionality}
Ransomware serves as a broad term encompassing a category of malicious software designed to coerce victims into paying a specified ransom. Within the context of this text, our aim is to furnish readers with a foundational understanding of ransomware, followed by an in-depth exploration of strategies to mitigate its impact. This inaugural chapter endeavors to provide a historical backdrop of ransomware, alongside an elucidation of the ransomware attack sequence.
\\
Central to this mode of digital coercion are two primary variants, further delineated by the families they represent. These variants primarily involve ransomware that either encrypts, obfuscates, or obstructs access to files, or those that impede access to or lock users out of systems outright. Not confined to specific geographical locations or operating systems, these threats can manifest across diverse devices. Whether it be Android devices, iOS systems, or Windows platforms, all are susceptible to exploitation by ransomware. The manner in which a device is compromised may vary depending on the target, and the subsequent actions are contingent upon the capabilities of the device itself. However, discernible patterns often guide the actions of many extortionists.
\subsection{Anatomy of Ransomware Attack}
Let's talk about how ransomware is executed, as we now knows about what is ransomware, and what it is capable of doing. \\ So here in \autoref{fig:Ransomware Lifecycle}, it is shown that Ransomware works on 5-6 Stages of Life Cycle, we can ignore or broadly classify stages as per need, but mainly consists of these 5 Stages.\cite{liska2016ransomware}
\begin{figure*}[ht]
\centering
\includegraphics[width=\textwidth]{images/lifecycle.pdf}
\caption{Depiction of Life Cycle of ransomware}
\label{fig:Ransomware Lifecycle}
\end{figure*}
\begin{enumerate}[label=\arabic*.]
\item Infection:
\begin{enumerate}[label=\alph*.]
\item Delivery: Ransomware reaches a target system through various methods like phishing emails with malicious attachments, infected websites, RDP (Remote Desktop Protocol) vulnerabilities, or unpatched software.
\item Initial Foothold: Once the ransomware gains access, it exploits vulnerabilities to establish a foothold on the system. This might involve creating new user accounts, disabling security software, or spreading laterally across the network.
\end{enumerate}
\item Encryption:
\begin{enumerate}[label=\alph*.]
\item File Targeting: The ransomware identifies and targets critical files and documents on the victim's device or network. This could include financial records, personal data, business documents, or system files.
\item Encryption Process: Using strong encryption algorithms, the ransomware encrypts the targeted files, making them inaccessible to the victim. This process might vary depending on the specific ransomware strain.
\item Encryption Key Generation: During encryption, the ransomware creates a unique decryption key for each victim. This key is essential for regaining access to the encrypted files. However, the attackers keep this key for themselves.
\end{enumerate}
\item Ransom Demand:
Ransom Note: The ransomware displays a ransom note on the victim's screen. This note explains the situation, highlights the urgency, and outlines the attacker's demands. It typically includes instructions on how to pay the ransom, often in cryptocurrency like Bitcoin, due to its anonymity. The note might threaten to permanently delete backups, leak stolen data, or launch further attacks if the ransom isn't paid within a specific time frame.
\item Verification (Hypothetical Scenario):
\begin{enumerate}[label=\alph*.]
\item Ransom Payment: If the victim chooses to pay (not recommended), they'd follow the attacker's instructions, which might involve sending cryptocurrency to a specific address.
\item Verification (Unreliable): In an ideal scenario (which isn't guaranteed with cybercriminals), the attackers might verify the payment received.
\end{enumerate}
\item Decryption (Hypothetical Scenario):
\begin{enumerate}[label=\alph*.]
\item Decryptor Delivery (Unreliable): Again, assuming the attackers keep their word, they might provide a decryptor tool or the unique decryption key to the victim.
\item Decryption Process: The victim would then use the decryptor or key to decrypt the compromised files and regain access.
\end{enumerate}
\subsubsection{Safety Precautions and Measures:}
\item Recovery (Recommended Approach):
\begin{itemize}
\item Isolate Infected Systems: Disconnect affected devices from the network to prevent further spread.
\item Report the Attack: Inform law enforcement agencies and relevant authorities to assist with investigation and potential recovery efforts.
\item Restore from Backups: If you have up-to-date backups, restore your critical data from a safe, isolated location.
\item Remediate Vulnerabilities: Patch software vulnerabilities, update security software, and implement stronger access controls to prevent future attacks.
\end{itemize}
\end{enumerate}
\subsection{Impact of Ransomware}
Ransomware attacks have emerged as one of the most significant cybersecurity threats facing individuals, businesses, and organizations worldwide. These malicious incidents not only result in financial losses but also have far-reaching consequences that extend beyond immediate monetary damages. In this section, we explore the multifaceted impact of ransomware attacks on various stakeholders and the broader cybersecurity landscape.
\begin{enumerate}
\item \textbf{Financial Losses:} Ransomware attacks inflict substantial financial losses on victims, including ransom payments, remediation costs, and potential revenue disruptions. The direct financial impact of ransomware incidents can be staggering, with ransom demands ranging from hundreds to millions of dollars, depending on the scale and severity of the attack.
\item \textbf{Data Breaches and Confidentiality Breaches:} Ransomware attacks often involve the exfiltration of sensitive data from compromised systems, posing a significant risk of data breaches and confidentiality breaches. Cybercriminals may threaten to release or sell stolen data if ransom demands are not met, leading to reputational damage, legal liabilities, and regulatory penalties for affected organizations. The exposure of confidential information can have long-term consequences for individuals and businesses, eroding trust and undermining brand integrity.
\item \textbf{Operational Distruptions:} The operational disruptions caused by ransomware attacks can have profound implications for business continuity and productivity. Ransomware-induced downtime can paralyze critical systems and services, disrupting day-to-day operations, customer interactions, and supply chain activities. The inability to access essential data and applications hampers decision-making processes and impedes organizational agility, resulting in cascading effects across the entire enterprise.
\item \textbf{Reputational Damage:} Ransomware attacks can inflict lasting reputational damage on affected organizations, eroding stakeholder trust and confidence. Public disclosure of a ransomware incident can tarnish a company's reputation, leading to loss of customers, partners, and investors. The perception of inadequate cybersecurity measures or mishandling of sensitive data can irreparably harm brand reputation and undermine competitive advantage in the marketplace.
\item \textbf{Legal and Regulatory Consequences:} Ransomware attacks carry significant legal and regulatory implications for organizations, particularly those operating in regulated industries. Non-compliance with data protection laws and regulations, such as the \ac{GDPR} or the \ac{HIPAA}, can result in severe penalties and sanctions. Organizations may face lawsuits, regulatory investigations, and class-action claims stemming from ransomware-related data breaches, further compounding the fallout from the attack.
\end{enumerate}
\clearpage
\newpage
\phantomsection
\section*{Chapter 2}
\addcontentsline{toc}{section}{Chapter 2}
\section{Literature Review}
The landscape of ransomware threats continues to evolve rapidly, posing significant challenges to cybersecurity practitioners and researchers alike. As organizations grapple with the escalating frequency and sophistication of ransomware attacks, the need for effective detection and mitigation strategies has become increasingly paramount. In this chapter, we conduct a comprehensive literature review to explore the existing body of research and solutions in the domain of ransomware detection, with a particular focus on the integration of Software-Defined Networking (SDN) technology.
The motivation for this literature review stems from the urgent need to address the pervasive threat of ransomware attacks and the limitations of traditional networking approaches in combating this menace. Traditional networking architectures, characterized by their reliance on hardware-based infrastructure and distributed control mechanisms, are ill-equipped to cope with the dynamic and evolving nature of modern cyber threats, including ransomware. These legacy systems often lack the agility, scalability, and programmability required to detect and mitigate ransomware attacks effectively.
Traditional networking approaches suffer from several inherent limitations that hinder their efficacy in ransomware detection and mitigation. These include:
\begin{enumerate}
\item \textbf{Heavy and Non-Programmable Infrastructure:} Traditional networking infrastructures consist of complex, hardware-based components, such as routers, switches, and firewalls, that are challenging to manage and configure. The reliance on proprietary hardware limits the flexibility and agility of traditional networks, making them unsuitable for rapidly adapting to changing threat landscapes.
\item \textbf{Lack of Real-Time Monitoring and Mitigation:} Traditional networking architectures are constrained by their static and reactive nature, making it difficult to detect and respond to ransomware attacks in real-time. The absence of centralized control and orchestration mechanisms impedes the ability to implement dynamic security policies and conduct timely threat analysis, leaving organizations vulnerable to ransomware incidents.
\end{enumerate}
In contrast, Software-Defined Networking (SDN) represents a paradigm shift in network architecture, offering a more agile, scalable, and programmable alternative to traditional networking approaches. By decoupling network control and data forwarding functions and centralizing network management through software-defined controllers, SDN enables organizations to overcome the limitations of traditional networking and enhance their cybersecurity posture.
\clearpage
\subsection{SDN}
In traditional networking, data moves across devices like switches and routers through packets, where each device makes forwarding decisions based on its own control logic. This setup integrates the control plane (managing routing protocols) and data plane (forwarding packets) within each device. \cite{nadeau2013sdn}
Software-Defined Networking (SDN) separates the control plane from the data plane, centralizing control logic in a software-defined controller. This controller communicates with forwarding devices to dynamically configure network behavior. Unlike traditional setups, SDN offers centralized management, dynamic policy enforcement, and greater flexibility in network customization and response to changing conditions.
\begin{figure*}[ht]
\centering
\includegraphics[height = 12 cm]{images/sndvtra.pdf}
\caption{Differences between Traditional and SDN Networking}
\label{fig: SDN vs Tranditional Comparision}
\end{figure*}
As shown in \autoref{fig: SDN vs Tranditional Comparision}, we can say that, using SDN we can easily manage and manipulate our network flow as per our requirements.
\subsection{Planes of Network}
Every single network device typically has to perform three distinct activities, which are mapped correspondingly to three different planes of the network: data, control and management, as depicted in \autoref{fig:Data Flow working Diagram}
\begin{figure*}
\centering
\includegraphics[height= 8cm]{images/Data Flow Diagram.drawio.pdf}
\caption{Data Flow working Diagram}
\label{fig:Data Flow working Diagram}
\end{figure*}
\subsubsection{Data Plane}
\begin{itemize}
\item The data plane is responsible for processing the transit traffic, which decides what to do with packets arriving on an ingress interface.
\item It is also termed as forwarding plane, as it mainly refers to a forwarding table to decide proper egress interface.
\item From the perspective of packets the data plane usually handle end-station / user-generated packets that are always forwarded by network devices to other end-station devices.
\end{itemize}
\subsubsection{Control Plane}
\begin{itemize}
\item The control plane is concerned with collecting, processing and managing the network information in order to decide the forwarding behavior.
\item It typically includes various tables and suite of protocols that work on these tables. Hence, control plane handles network device generated/received packets that are used for the creation and operation of the network itself.
\item Typical protocols that run at control plane are routing, interface state management, connectivity management, adjacent device discovery, topology or reachability information exchange and service provisioning.
\end{itemize}
\subsubsection{Management Plane}
\begin{itemize}
\item The management plane is used to interact, or monitor, with the device, in order to manage the network.
\item The management plane also runs its own suite of protocols such as \ac{SNMP}, apart from supporting configurations of interfaces, network (IP subnets) and control-plane protocols.
\item In a traditional network device, the data-plane activities are carried out by dedicated hardware (or ‘high-speed code’), while the control plane operations are handled by the device CPU.
\end{itemize}
\newpage
\section{Basics of Switch}
\begin{figure*}[ht]
\centering
\includegraphics[height = 8 cm]{images/basicSwitch.drawio.pdf}
\caption{Schematic of Traditional Switch Workings}
\label{fig:Schematic of Traditional Switch Workings}
\end{figure*}
\begin{itemize}
\item The basic job of a network switch is to make a forwarding decision (control plane) and subsequently forward the data toward a destination (data plane), shown in \autoref{fig:Schematic of Traditional Switch Workings}.
\item To make forwarding decisions very quickly, the network switch is equipped with very specialized memory resources \ac{TCAM} to hold the forwarding information. The specialized nature of this memory makes it difficult and expensive for each switch to have large quantities of memory available for holding information about a large network.
\end{itemize}
\subsection{Traditional Networking}
\begin{itemize}
\item Traditionally, routers/L3 switches have two high-level functionalities:
\begin{enumerate}
\item Control-plane functionality (routing protocols, QoS protocols)
\item Forwarding functionality (high speed forwarding based on rules stored in the forwarding tables)
\end{enumerate}
\item Control plane and data plane are coupled!, \autoref{fig:Schematic of Traditional Switch Workings}.
\end{itemize}
\subsection{Software Defined Networking}
\begin{figure*}[ht]
\centering
\includegraphics[height=8cm]{images/schematicSDNSw.drawio.pdf}
\caption{Schematic of SDN Switch}
\label{fig:Schematic of SDN Switch}
\end{figure*}
\begin{itemize}
\item SDN is about refactoring of the relationship between network devices and the software that controls them.
\item Replacing the distributed control-plane with a logically centralized ones, \autoref{fig:Schematic of SDN Switch}.
\end{itemize}
\subsection{Overview of SDN vs Traditional Netowrk Setup}
\begin{table}[ht]
\centering
\caption{Comparison of Traditional Network and Software Defined Network}
\label{tab:network-comparison}
\begin{tabular}{ccc}
\toprule
\textbf{Criteria} & \textbf{Traditional Network} & \textbf{Software Defined Network} \\
\midrule
Network Management & Difficult: Apply on each devices & Easy: Centrally Programmable \\
Global Network View & Difficult & Central View at Controller \\
Time for update/ Error Handling & Difficult: takes months & Easy: with Software Based \\
Attack Detection and Mitigation & Difficult & Easier \& Quick \\
Availablity of Controller & Not Relevent & Important \\
% Add more rows as needed
\bottomrule
\end{tabular}
\end{table}
\clearpage
\newpage
\section*{Chapter 3}
\section{Proposed Work}
In this chapter, we introduce our proposed work. We give a detailed description of our approach and explain the architecture of our model by describing each sub module in detail. We also explain the workflow of our proposed solution through a simple example.
\subsection{Approach}
\begin{figure*}[ht]
\centering
\includegraphics{images/ConceptDesign.drawio.pdf}
\caption{Conceptual design of the proposed SDN-based mechanism}
\label{fig:Conceptual design of the proposed SDN-based mechanism}
\end{figure*}
Our proposed SDN-based detection and mitigation mechanism relies on inspection of the \ac{DNS} traffic with dynamic black- listing, which particularly observes the network traffic for the presence of malicious domain names or IP addresses used during WannaCry’s communication with the C \& C server. %(as identified in Sections 3 and 4 ).
As soon as such an attempt is detected, it is blocked. The list of malicious domain names is commonly specified in a local blacklisting file or by using online databases. One of the main benefits of this method is that it provides simplicity in implementation and effectiveness in detection and mitigation of malware activity. Therefore, this approach was used as a basis for our proposed mechanism.
\\
The conceptual design of the proposed mechanism is depicted in \autoref{fig:Conceptual design of the proposed SDN-based mechanism}. The main detection and mitigation functionality is carried out by the developed SDN application. This application has been implemented on the SDN controller, which allows inspecting the entire network traffic and issuing instructions to the OpenFlow switch to update its flow table by installing appropriate rules. In \autoref{fig:Conceptual design of the proposed SDN-based mechanism}, numbers 1 to 5 represent different steps of the detection and mitigation process and are explained below:
\begin{enumerate}
\item Malicious \ac{TCP} traffic from an infected host arrives to the OpenFlow switch. This traffic includes \ac{SMB} probing and DNS query packets generated by WannaCry.
\item Assuming that initially there is no flow entry for the given infected host, the switch redirects all TCP traffic to the controller (this is the default action), in order to obtain further instructions on how to handle these packets.
\item All packets that are received by the controller, are passed to the application. The application performs the fol- lowing functions: parses packets, checks against the blacklist database file, and creates new flow entries in the switch. After receiving the packets, the application parses them in order to find any matches with WannaCry’s inherent network indicators.
\item The packets are checked against the database file containing the list of IP addresses and simultaneously with any matches to the TCP port numbers used by WannaCry.
\item If malicious communication is detected, the application creates a new flow entry in the switch instructing it to block the malicious traffic originating from the infected host.
\end{enumerate}
\begin{table}[ht]
\centering
\caption{Entries in the flow table of the OpenFlow switch}
\label{tab:firewall-rules}
\begin{tabular}{ccccccc}
\toprule
\textbf{Rule} & \textbf{Src addr} & \textbf{Src port} & \textbf{Dst addr} & \textbf{Dst port} & \textbf{Protocol} & \textbf{Action} \\
\midrule
1 & 10.0.0.1 & 80 & 203.0.113.5 & 443 & TCP & Allow \\
2 & 10.0.0.2 & 22 & 192.168.1.10 & 1025 & UDP & Deny \\
3 & 172.27.38.83 & Any & 192.168.1.20 & 53 & Any & Allow \\
% Add more rows as needed
\bottomrule
\end{tabular}
\end{table}
For example, the new flow table of the OpenFlow switch may contain the entries shown in \autoref{tab:firewall-rules}. In this case, the IP address 192.168.180.130 was taken from the blacklist database file (Step 3) and the relevant TCP port numbers (445, 139, etc.) are known to be used by the SMB protocol.
\subsection{Static Analysis of WannaCry}
Static ransomware analysis is a method of examining ransomware code and characteristics without executing the malicious software. By analyzing the ransomware's code structure, file properties, and other attributes, static analysis helps uncover potential indicators of compromise (IOCs), encryption algorithms, and other critical information. This approach assists in understanding the ransomware's functionality and behavior, aiding in the development of detection and mitigation strategies.
\begin{table}[ht]
\centering
\caption{WannaCry encryption components: Hashes and file types.}
\label{tab:WannaCry Exec Components}
\begin{tabular}{ccccccc}
\toprule
\textbf{Parameter} & \textbf{Encryption Component} \\
\midrule
MD5 & c5d40dff30148a6a7a9d091f2a31d7c1 \\
SHA1 & e3897618a8189f632459e53f4b3e7459fd7f9917 \\
SHA256 & c4f868791586ae4c2d25b0d4bcce85b8bef5f5b673d471de2e743156e9e8dfaf \\
File Type & PE32+ executable (GUI) x86-64, for MS Windows \\
% Add more rows as needed
\bottomrule
\end{tabular}
\end{table}
\begin{table}[htbp]
\centering
\caption{WannaCry worm components: Hashes and file types.}
\label{tab:WannaCry Worm Components}
\begin{tabular}{ccccccc}
\toprule
\textbf{Parameter} & \textbf{Worm Component} \\
\midrule
MD5 & e8a30656287fe831c9782204ed10cd68 \\
SHA1 & e3897618a8189f632459e53f4b3e7459fd7f9917 \\
SHA256 & 4625f4c125f3ce2cd4d2c8365d2996bfed67a0f545e08c215307edf944b3af88 \\
File Type & PE32+ executable (GUI) x86-64, for MS Windows \\
% Add more rows as needed
\bottomrule
\end{tabular}
\end{table}
We analyzed two WannaCry executables: the worm component and the
encryption component. Their corresponding hashes and basic characteristics are shown in \autoref{tab:WannaCry Exec Components} and \autoref{tab:WannaCry Worm Components}. Below we present our main findings from the static 175 analysis.
Analysis with the Pestudio tool has revealed that the worm and the en-cryption components contain dynamic-link libraries (DLLs), as shown in \autoref{tab:DLL-Link File} and \autoref{tab:DLL-Link1 File}. During its execution, the worm invokes the iphlpapi.dll in order to retrieve network confguration settings for the infected host. The kernel32.dll 180 and msvcrt.dll are two most invoked libraries by the encrypter. It was found that WannaCry uses Microsoft's crypto, file management, and C runtime file \ac{API}. The Crypto API library is used to generate and manage random symmetric and asymmetric cryptographic keys.
\begin{table}[ht]
\centering
\caption{Dynamic Link Libraries (DLLs) invoked by WannaCry's encryption component}
\label{tab:DLL-Link File}
\begin{tabular}{ccc}
\toprule
\textbf{Library} & \textbf{Imports} & \textbf{Descriptions} \\
\midrule
USERS32.dll & 2& Multi-UserWindows USER API Client\\
KERNEL32.dll & 10& Windows NT BASE API Client\\
ADVAPI32.dll & 1& Advanced Windows 32 Base API\\
WS2\_32.dll & 1& Winsock DLL Loading\\
% Add more rows as needed
\bottomrule
\end{tabular}
\end{table}
\begin{table}[ht]
\centering
\caption{Dynamic Link Libraries (DLLs) invoked by WannaCry's worm component}
\label{tab:DLL-Link1 File}
\begin{tabular}{ccc}
\toprule
\textbf{Library} & \textbf{Imports} & \textbf{Descriptions} \\
\midrule
USERS32.dll & 2& Multi-UserWindows USER API Client\\
KERNEL32.dll & 10& Windows NT BASE API Client\\
ADVAPI32.dll & 1& Advanced Windows 32 Base API\\
WS2\_32.dll & 1& Winsock DLL Loading\\
msvcp60.dll & 2 & Windows NT C++ Runtime Library \\
msvcrt.dll & 28 & Windows NT CRT \\
% Add more rows as needed
\bottomrule
\end{tabular}
\end{table}
\subsection{Dynamic Analysis of Ransomware}
\label{sec: Dynamic Analysis of Ransomware}
% Our dynamic analysis has revealed that, when started, the worm component invokes the \textit{InernetOpenUrl} function and attempts to establish a connection with the following domain
Dynamic analysis of WannaCry was conducted in a virtual test environment. A custom network was created to monitor DNS queries made by the ransomware across internal and external networks via port 445. The REMnux machine served as a DNS and HTTP server, intercepting network communications using Wireshark. The analysis showed that the ransomware attempted to connect to a specific domain upon startup using the \textit{InernetOpenUrl} function: \url{ieonline.microsoft.com}, as shown in \autoref{fig:fakedns-capture} we have verified that there is no such domain is mentioned in official Microsoft Support \url{https://learn.microsoft.com/en-us/windows/privacy/manage-windows-1903-endpoints}.
\begin{figure}[hbtt]
\centering
\includegraphics[width= \textwidth]{images/urlfakedns.pdf}
\caption{FakeDNS Captured Domain Name}
\label{fig:fakedns-capture}
\end{figure}
We have also found that, in the DNS record, our ransomware ping maximum numbers of times url is \url{dns.msftncsi.com}, which is unusual for request, as per Pi-Hole Website \cite{pi-hole}, it is seen that many request are made.
Our analysis has also shown that WannaCry attempts to establish persistence on the infected device by:
\begin{itemize}
\item Creating an entry in the Windows registry, so that it is invoked every time the infected computer reboots.
\item Adding itself to the AutoRun feature of Windows.
\item Utilizing the icacls command to enable full access to all files on the infected device.
\item Deleting the backup copies and preventing the device rebooting in the safe mode.
\item Attempting to eliminate SQL and MS Exchange database processes by executing certain shell commands.
\end{itemize}
\subsubsection{Challenges of dynamic malware analysis}
\begin{itemize}
\item Dynamic malware analysis is more time-consuming and resource-intensive than static analysis. It can also pose a threat if the virtual environment is not completely isolated from other systems.
\item Additionally, while executing the malware helps teams understand more about a sample, it can also alert malware authors when their samples run.
\item Sophisticated malware can also sometimes detect when it is executed inside an isolated virtual environment instead of a natural environment. It does this by observing registry keys, processes or even whether the mouse and keyboard are actively in use. Some malware that can identify the difference might also employ techniques to prevent accurate analysis. It is challenging to create a realistic sandbox that can fool sophisticated malware, but it certainly isn't safe to execute a malware sample on a live system.
\end{itemize}
\subsection{Approach To Detect}
Since we using SDN approach to blocking ransomware to spread by using counter measures by blocking host in network on basis of Capturing malicious operation like SMB exploitation and pinging unwanted/ unverified Domain Name and IP Address.
But this working model already done with firewall, so we adapted new approach i.e., \ac{DPI} \cite{enwiki:1223318045}, based on the concept, this process will capture the packet in real time in control plane of the network, which is actually a pox controller, then it will match the pattern of signature with pre-existing samples, or if sample is not available then check for any piece of code in packets which seems to be malicious in nature, like containing any kinds of crypto-currency addresses, or contains any functions which is calling kernel level objects, as we learnt in static analysis of malware.
After proper identification of packets, the detection system will notify the POX controller to block the particular host, in a network, because it might be possible, as we assumed the scenario that some legitimate users in network, can also share ransomware files as shown in \autoref{fig:legitimate Scenario}.
The applied algorithm and approach are show in \autoref{Checking and Analysing Packets}
\begin{figure}[ht]
\centering
\includegraphics[height = 8cm]{images/Scene1.pdf}
\caption{Legitimate node become attacker}
\label{fig:legitimate Scenario}
\end{figure}
\subsection{Overview of Deep Packets Inspection}
\textit{Deep packet inspection (DPI)}, alternatively referred to as information extraction or complete packet inspection, serves as a comprehensive form of network packet filtering. It scrutinizes both the data and header sections of transmitted packets at inspection points, identifying and filtering out any content that violates protocol standards or poses security risks, such as spam, viruses, and intrusions.
Furthermore, DPI plays a pivotal role in directing packets to their intended destinations. In essence, it possesses the capability to identify, categorize, block, or reroute packets containing specific code or data payloads that might evade detection or redirection by conventional packet filtering methods. Unlike traditional packet filtering, DPI delves deeper into packet contents beyond mere header examination.
The most common inspection used consists in comparing the packet content against certain attributes and checking for hits in any of the accessible layers. Depending on the application in which DPI is used the inspection process could be customized in terms of what needs to be matched, such as traffic from a certain IP address etc. DPI includes port-based analysis that enables the identification of the port number by inspecting the \textbf{TCP} or \textbf{UDP} headers and thus determining which protocol was used to generate the packet. Statistical analysis can also be employed as a DPI method, but it is not payload specific and rather uses several approaches to classify traffic based on port numbers or timestamps. We argue, however, that both port-based and statistical analysis methods are not exactly DPI but could be classified as what is known as \ac{SPI} \textcite{mochalski2009} because the payload is not involved at any stage of the inspection process.
There exist multiple DPI methods, the variation is determined based on how the payload is matched to keywords. Understanding the logic behind DPI is an important step to find out which method should be avoided and which can be improved. Some of the methods can be performed as either string matching or regular expression matching \textcite{Xu2016ASO}. We are mainly interested in two methods and the ones that are most commonly used among all \textcite{Xu2016ASO}, they are as follows:
\begin{figure}[h]
\centering
\includegraphics[height = 6.5cm]{images/classification.drawio.pdf}
\caption{Classification of DPI methods}
\label{fig:Classification of Methods DPI}
\end{figure}
\begin{itemize}
\item \textbf{Automaton-based:} This involves both regular expressions and string matching. A finite state automaton is created for each string or packet. The input can take multiple states until it is able to match itself to the required expression or string.
\item \textbf{Heuristics-based:} A trial-and-error approach to find a specific string or expression in the payload.
Firewalls play an important role in protecting the endpoint device from malware and supporting IDS by blocking predefined IP addresses known as a security threat. How deep a firewall inspects a packet would depend on the firewall type and configuration
\end{itemize}
\subsubsection{Code Preprocessing}
Code preprocessing is a crucial element of signature-based detection technology. This process encompasses several tasks, including type analysis, decompression, unpacking, syntax analysis, and the pretreatment of macro viruses. Type analysis is dedicated to identifying the types of object programs, while decompression is applied to programs that have been compressed. Unpacking is specifically geared towards executable programs, such as those in PE, NE, and other formats. Syntax analysis is used to identify various script programs, including VBS and JS scripts.
Initially, the system identifies the type of the input program to determine the appropriate subsequent action. For compressed programs, the system decompresses the content. For script programs, including macro programs, it performs a syntax analysis and generates output based on the analysis. This output is then used in the next step for feature matching. In the case of binary programs, the system differentiates between binary executable programs (like PE, NE, COM, DOS, etc.) and other binary types. If a binary executable file is packed, it is processed through the unpacking module. Finally, the results from code preprocessing are used for further feature matching.
\subsubsection{Matching Algorithm}
The primary method utilized in scanning programs is known as pattern matching. This technique involves comparing segments of the target program's code against a database of known malicious code. If no matches are found, the target program is classified as benign, indicating a failure in matching. Conversely, if one or more matches are detected, the program is flagged as potentially malicious, indicating a successful match. This process is akin to string pattern matching algorithms.
According to the number of strings that can be processed at the same time and probabilities there is a certain number of mismatches in the matching process, the matching algorithm can be divided into the following two categories.
\begin{itemize}
\item Single pattern extract matching algorithms.
\item Multi-pattern extract matching algorithms.
\end{itemize}
\subsubsection{Comparison of Deep Packet inspection vs Conventional Inspection}
\begin{table}[ht]
\centering
\caption{Comparison of Deep Packet Inspection vs Conventional Packet Filtering}
\label{table:comparison}
\begin{tabular}{p{0.45\linewidth} p{0.45\linewidth}}
\toprule
\textbf{Conventional Packet Filtering} & \textbf{Deep Packet Inspection (DPI)} \\
\midrule
Reads only the header information of each packet. & Analyzes both the header and data sections of packets. \\
Limited in sophistication due to technology constraints. & Enabled by advancements in technology, allowing for more thorough analysis. \\
Similar to reading the title of a book without evaluating the content inside. & Comparable to picking up a book, cracking it open, and reading it from cover to cover. \\
Less effective in detecting complex threats and security risks. & More comprehensive, capable of identifying and blocking sophisticated threats, such as malware and intrusions. \\
Often used in basic firewall configurations. & Deployed in modern security systems for enhanced threat detection and prevention. \\
\bottomrule
\end{tabular}
\end{table}
\subsubsection{Limitation of our approach}
While our approach offers significant advantages in terms of security enhancement, it's important to acknowledge several limitations that may arise. These include:
\begin{enumerate}
\item Deep packet inspection stands as a formidable defense against various cyber threats, including denial of service attacks, buffer overflow attacks, and certain types of malware. However, it also holds the potential for crafting similar attacks.
\item While offering enhanced security, deep packet inspection adds complexity to existing firewall and security software setups. Regular updates and policy reviews are essential to maintain its efficacy.
\item The rigorous scrutiny involved in deep packet inspection can introduce network latency by necessitating significant resource allocation. Storing packets temporarily for analysis may further contribute to delays in transmission and reception. Leveraging pre-existing samples from past network communications could expedite packet processing decisions.
\end{enumerate}
\subsection{Results}
In this work, we detail our investigations into ransomware behaviors, specifically focusing on the infamous WannaCry ransomware, within a controlled virtual lab environment. This analysis serves as a foundation for our proposed SDN-based security framework. Our framework leverages the capabilities of OpenFlow, the predominant standard in software-defined networking (SDN) as referenced in \cite{10.1145/1355734.1355746, KazuyaSUZUKI2014}, to enhance ransomware detection and mitigation efforts.
The cornerstone of our framework is the integration of deep packet inspection (DPI) techniques within the POX controller to monitor network traffic for indicators of compromise associated with ransomware, such as WannaCry. By scrutinizing packet contents in real-time, our system identifies suspicious activities that signify ransomware communication and behavior. Upon detecting such activities, our solution dynamically updates the flow tables in OpenFlow switches to isolate and block traffic from infected hosts, effectively preventing the spread of the infection.
Our DPI-based approach enhances the traditional blacklist-based systems, which Ceron et al. \cite{7543792} noted could be dynamically adjusted to incite more malware activity detection compared to static systems. However, instead of relying solely on pre-defined lists of malicious IP addresses or domain names, our system examines the content of the network traffic itself. This method addresses the primary limitation of blacklist dependency and the inability to detect previously unknown threats.
The effectiveness of our DPI-enhanced SDN framework has been validated through rigorous testing with multiple samples of WannaCry in a simulation environment, using OpenVswitch and the POX controller. Our experimental results indicate a high detection rate of 97–98\% with a reduced false positive rate of only 4–5\%. These figures underscore the robustness of our solution in accurately identifying and mitigating ransomware threats.
\subsubsection{Points to Consider}
\begin{enumerate}
\item \textbf{False Positives/Negatives:} While our system demonstrates a low rate of false positives, continuous refinement of DPI algorithms is essential to further reduce erroneous detections and to adapt to evolving ransomware tactics.
\item \textbf{Scalability and Performance:} Implementing DPI at scale may introduce latency and require substantial processing power. It's crucial to balance security measures with network performance to maintain system efficiency.
\item \textbf{Update and Maintenance:} Regular updates to the DPI signatures and monitoring algorithms are required to keep up with new ransomware variants and sophisticated evasion techniques.
\item \textbf{Privacy Concerns:} The use of DPI raises privacy issues, as it involves deep inspection of packet contents, which could potentially contain sensitive information. Implementing stringent data handling and privacy policies is vital to safeguard user data.
\end{enumerate}
Our proposed framework thus not only provides a high degree of accuracy in detecting ransomware like WannaCry but also offers a scalable and dynamically adaptable solution suitable for current and future network security landscapes.
\clearpage
\newpage
\section*{Chapter 4}
\section{Detailed Info}
In this section, we provide a comprehensive overview of our research endeavors, focusing on the development and analysis of ransomware. Our work involved the creation of a sophisticated ransomware framework, followed by thorough static and dynamic analysis conducted within a secure sandbox environment. Through meticulous examination and experimentation, we gained valuable insights into the behavior and impact of ransomware, shedding light on its modus operandi and potential mitigation strategies. The following subsections delve deeper into each aspect of our research, detailing the methodologies employed and the key findings obtained.
\subsection{Experimental Setup}
\begin{figure}[htt]
\centering
\includegraphics{images/NetworkSetip.drawio.pdf}
\caption{Network Setup and Connection for Experiment}
\label{fig:Network Setup and Connection for Experiment}
\end{figure}
The network configuration entails the utilization of two physical Windows nodes in conjunction with a singular Ubuntu server, tasked with fulfilling the roles of both the \textbf{OpenVswitch} and \textbf{POX Controller}. This amalgamation is necessitated by constraints in hardware availability or the unavailability of multiple computing units.
For the Ubuntu Server, a hardware configuration comprising an Intel Core i5 - 4\textsuperscript{th} Generation processor, accompanied by 12GB of RAM, has been employed. Node 1 is equipped with an Intel Pentium 4 processor and 4GB of RAM, while Node 2 features an Intel Core i5 - 8\textsuperscript{th} Generation processor with 8GB of RAM.
\subsection{Creation of Ransomware}
\textbf{Disclaimer:}
While the research presented in this thesis involves the analysis of ransomware and its impact on cybersecurity, it is important to note that creating or distributing malicious software is illegal and unethical. As such, this thesis does not provide detailed instructions on the creation or propagation of ransomware. Rather, it focuses on the analysis of existing ransomware threats and the development of defensive strategies to mitigate their impact.
\textbf{Methodology:}
The research conducted for this thesis involved the analysis of ransomware samples, including the infamous WannaCry ransomware. Various techniques were employed to study the behavior and characteristics of these malware specimens, including static and dynamic analysis, network traffic monitoring, and reverse engineering.
\textbf{Technical Tools:}
The analysis was conducted using a combination of programming languages, libraries, and environments commonly used in cybersecurity research. This includes:
\begin{itemize}
\item \textbf{Programming Languages:} Python, C/C++
\item \textbf{Libraries/Frameworks:} Wireshark, IDA Pro, Ghidra
\item \textbf{Virtualization/Emulation:} VMware, VirtualBox
\item \textbf{Network Analysis Tools:} Wireshark, tcpdump
\end{itemize}
By leveraging these tools and methodologies, valuable insights were gained into the behavior and operation of ransomware, aiding in the development of effective defense mechanisms against such threats.
\subsection{Creation of Trojan Horse}
In the process of creating the Trojan file for our ransomware, we employed a technique known as \textit{steganography}. This method involves concealing binary data within an image file, allowing the malicious payload to remain undetected by users and security systems alike. By embedding the ransomware binary bits within the pixels of an innocuous-looking image, we aimed to facilitate the covert distribution of the Trojan file. This approach not only enhances the stealthiness of the ransomware, but also increases the likelihood of it being inadvertently triggered by unsuspecting users, thereby maximizing its effectiveness in carrying out its malicious objectives.
\subsection{Setting up Switch and Controller}
To create a software-defined networking (SDN) environment for our experiments, we first need to set up OpenVSwitch (OVS) as our virtual switch and the POX controller to manage network traffic.
\begin{enumerate}
\item \textbf{Install OpenVSwitch (OVS):} Begin by installing OpenVSwitch on your system. OVS is available for various platforms and distributions, and installation instructions can typically be found on the official OpenVSwitch website or through package managers.
\subsubsection{Installation of OVS Switch}
\begin{lstlisting}[language=bash]
$ sudo apt-get update && sudo apt-get upgrade
$ sudo apt install openvswitch-switch openvswitch-common
\end{lstlisting}
\item \textbf{Install POX Controller:} Next, Install the POX controller, which is a lightweight SDN controller written in Python. POX is widely used for research and educational purposes due to its simplicity and flexibility. You can download POX from its GitHub repository and follow the installation instructions provided.
\begin{lstlisting}[language=bash]
$ git clone http://github.com/noxrepo/pox
$ cd pox
$ ./pox.py log.level forwarding.policy6 openflow.of_01 --port=3030
\end{lstlisting}
\item \textbf{Setting up Bridge and interfaces} We after successful installation of OVS switch and POX Controller, we made bridge of 2 USB - ETH adapter to act as 2 new Ethernet PORT.
\begin{itemize}[label=$\rightarrow$]
\item First using \textbf{\textit{ifconfig}}, check the interface name of the ethernet ports.
\begin{lstlisting}[language=bash]
$ ifconfig
enx000010027967: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::acd9:e45f:d7e:9088 prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:20:02:4c txqueuelen 1000 (Ethernet)
RX packets 9969 bytes 12745218 (12.7 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 4885 bytes 433656 (433.6 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
enxf8e43b4b4829: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
ether a0:0c:1b:20:bc:4c txqueuelen 1000 (Ethernet)
RX packets 9969 bytes 12745218 (12.7 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 4885 bytes 433656 (433.6 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
\end{lstlisting}
\item Check whether OvS-switch working on or not using command \textbf{\textit{sudo ovs-vsctl show}}, if result shows
\begin{lstlisting}[language=bash]
$ sudo ovs-vsctl show
ad773ed2-f0b7-458b-beac-6ba704b1ed87
ovs_version: "2.17.9"
\end{lstlisting}
This verify that openvswitch working fine.
\item Now to add port (Network Interface) into OpenVswitch, first we need to create one \textbf{\textit{Bridge}}, namely \textit{br0}. Then add Interface into the bridge by following commands.
\begin{lstlisting}[language=bash]
$ sudo ovs-vsctl add-br br0
$ sudo ovs-vsctl add-port br0 enxf8e43b4b4829
$ sudo ovs-vsctl add-port br0 enx000010027967
$ sudo ovs-vsctl show
\end{lstlisting}
\textbf{OUTPUT}
\begin{lstlisting}[language=bash]
ad773ed2-f0b7-458b-beac-6ba704b1ed87
Bridge br0
Port br0
Interface br0
type: internal
Port enx000010027967
Interface enx000010027967
Port enxf8e43b4b4829
Interface enxf8e43b4b4829
ovs_version: "2.17.9"
\end{lstlisting}
\begin{lstlisting}[language=bash]
$ sudo ip addr add 192.168.1.1/24 dev br0
$ sudo ip link set br0 up
\end{lstlisting}
The above command is to turn on Link called \textit{br0}, so that it can make communication, and to listen the traffic in wireshark.
\item Now add iP address to Bridge \textit{br0}, so that it can act as Gateway for connected Node. and also set Protocol and Controller IP and port Number, so that whenever POX starts, then OVS connects to it, for Control Plane working.
\begin{lstlisting}[language=bash]
$ sudo ovs-vsctl set-controller br0 tcp:localhost:3030 protocol=OpenFlow10
\end{lstlisting}
Here we are using POX controller and OVS switch in the same Machine, so no need to mention the IP address of POX controller, but since we are using non-default port of Controller, so it is necessary to mention the port number.
\textbf{OUTPUT}
\begin{lstlisting}[language=bash]
ad773ed2-f0b7-458b-beac-6ba704b1ed87
Bridge br0
Controller "tcp:localhost:3030"
Controller "protocol=OpenFlow10"
Port br0
Interface br0
type: internal
Port enx000010027967
Interface enx000010027967
type: internal
Port enxf8e43b4b4829
Interface enxf8e43b4b4829
type: internal
ovs_version: "2.17.9"
\end{lstlisting}
\end{itemize}
\end{enumerate}
\subsection{Checking and Analysing Packets}
\label{Checking and Analysing Packets}
In this section, we outline the tools and techniques used to analyze network traffic and identify ransomware behavior. We utilized Wireshark, Yara, REMnux, and the open-source deep packet inspection tool nDPI to scrutinize packet patterns and behaviors associated with ransomware.
\subsubsection{Tools and Setup}
\begin{itemize}
\item Wireshark: This powerful network protocol analyzer allows for detailed inspection of packet data traversing the network. It's widely used for capturing and analyzing network traffic.
\item Yara: Known for its effectiveness in identifying and classifying malware, Yara is used to create descriptions of malware families based on textual or binary patterns. To install Yara on a Unix-based system, use the following commands:
\begin{lstlisting}[language=bash]
$ sudo apt-get update
$ sudo apt-get install yara
\end{lstlisting}
\item REMnux: A Linux toolkit for reverse-engineering and analyzing malware, which comes with pre-installed tools such as FakeDNS and HTTP Daemon for network analysis. as we discussed in \autoref{sec: Dynamic Analysis of Ransomware}.
\item nDPI: This tool performs deep packet inspection (DPI) to classify and analyze network traffic. It can be installed and used as follows:
\begin{lstlisting}[language=bash]
$ sudo apt-get update
$ sudo apt-get install libpcap-dev
$ git clone https://github.com/ntop/nDPI.git
$ cd nDPI
$ make
\end{lstlisting}
\item Use nDPI to listen to network traffic on the interface br0 and log the output to a CSV file:
\begin{lstlisting}[language=bash]
$ cd nDPI/examples
$ sudo ./ndpiReader -i br0 -C /home/ovs/Documents/log.csv -R
\end{lstlisting}
Below are the screenshots from our experiment, which demonstrate how nDPI captured and inspected packets containing potential harmful content, subsequently assigning a risk score. \autoref{fig: nDPI Capture and showing Risk Score}
\begin{figure}[httb]
\centering
\includegraphics[width = \textwidth, height = 10cm]{images/risk_score.pdf}
\caption{nDPI Capture and showing Risk Score}
\label{fig: nDPI Capture and showing Risk Score}
\end{figure}
In our analysis, we utilized Wireshark to cross-check and examine packet data related to ransomware activities. Our findings indicated that ransomware, particularly those developed with modern programming languages like Python, predominantly support the x64 architecture.
\subsubsection{Key Observation:}
\begin{itemize}
\item \textbf{Architecture Dependency:} Both open-source and trojanized ransomware samples demonstrated a consistent characteristic—they are designed to run only on x64 architecture systems. This constraint was evident in the packet payloads we analyzed.
\item \textbf{Characteristic Packet Content:} A notable feature in the payload of these ransomware packets was the ASCII message: "This program cannot run in DOS mode." This message is indicative of programs compiled for 64-bit systems, which are incompatible with older DOS environments. The corresponding ASCII pattern observed in the packet data is as follows:
\begin{lstlisting}[language=bash]
54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e
6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f
53 20 6d 6f 64 65 2e
\end{lstlisting}
\end{itemize}
\end{itemize}
Based on our findings using signature-based detection and deep packet inspection with the nDPI open source tool, we have identified consistent patterns and high-risk scores in ransomware packets. These insights provide a strong foundation for developing a detection algorithm. By leveraging deep packet inspection to analyze packet contents and match against known ransomware signatures, we can accurately assess risk scores and trigger alerts or mitigation actions. This approach enhances our ability to detect and respond to ransomware threats effectively.
\subsection{Applying Algorithm to Detect and Block}
\label{Applying Algorithm to Detect and Block}
Combining the insights gleaned from our exploration of packet analysis in \autoref{Checking and Analysing Packets} with the versatile capabilities of the POX Python module, we've crafted a bespoke algorithm primed to tackle ransomware head-on. Armed with the Yara module for pattern matching prowess, our algorithm swiftly discerns suspicious packet patterns, springing into action at the first sign of trouble. Picture this: a relentless 15-minute interval cycle, where our algorithm diligently reassesses network traffic, granting clemency to innocent packets while swiftly thwarting malicious ones. But wait, there's more! Should the threat persist, our system seamlessly escalates, blocking transmission for an additional 15-minute stretch. All the while, our trusty CSV log meticulously documents each move, capturing the ebb and flow of attacker tactics for ongoing strategy refinement.
As we pivot from strategy to implementation, our algorithm emerges as the linchpin of our defensive arsenal, orchestrating a symphony of pattern recognition, decision-making, and adaptive response. Fusing the power of the POX Python module with the precision of the Yara pattern matching engine, it embodies a proactive ethos in the relentless pursuit of threat detection and prevention. With a finger firmly on the pulse of real-time analysis and rapid response, our algorithm stands as a stalwart guardian, fortifying our network infrastructure against the ceaseless onslaught of ransomware threats.
\newpage
\subsubsection{Psuedo Code of the Algorithm}
\begin{algorithm}
\caption{Detection and Prevention Alogrithm}
\begin{algorithmic}[1]
\State \Comment{Initialize csv\_log\_path and define YARA rule for ransomware pattern}
\State \textbf{Initialization:}
\State Initialize \texttt{csv\_log\_path}
\State Define YARA rule for ransomware pattern
\State Compile YARA rule
\State Initialize \texttt{blocked\_hosts} dictionary
\State \Comment{initialize\_csv(path)}
\State \textbf{Function:}
\State \textbf{try}
\State \ \ \ Open and write headers to the CSV file at \texttt{path}
\State \ \ \ Log success
\State \textbf{catch} Exception
\State \ \ \ Log error
\State \textbf{end try}
\State \Comment{write\_csv\_record(src\_ip, dst\_ip, protocol, action, path)}
\State \textbf{Function:}
\State \textbf{try}
\State \ \ \ Open and append packet record to the CSV file at \texttt{path}
\State \ \ \ Log success
\State \textbf{catch} Exception
\State \ \ \ Log error
\State \textbf{end try}
\State \Comment{unblock\_host(ip)}
\State \textbf{Function:}
\If{ip is in \texttt{blocked\_hosts}}
\State Remove ip from \texttt{blocked\_hosts}
\State Log the unblocking action
\EndIf
\end{algorithmic}
\end{algorithm}
\begin{algorithm}
\caption{Continuation}
\begin{algorithmic}[2]
\State \Comment{PacketLogger Class}
\State \textbf{Class:}
\Procedure{PacketLogger::\_\_init\_\_}{connection}
\State Assign connection and add listeners
\State Log initialization
\State Call \texttt{allow\_basic\_traffic()}
\EndProcedure
\Procedure{PacketLogger::allow\_basic\_traffic}{}
\State Send flow mods to allow ICMP and DNS traffic
\State Log the allowance of basic traffic
\EndProcedure
\Procedure{PacketLogger::\_handle\_PacketIn}{event}
\State Parse the packet from the event
\If{packet is incomplete}
\State Log warning and return
\EndIf
\If{packet is IPv4}
\State Extract src\_ip and dst\_ip
\If{src\_ip is in \texttt{blocked\_hosts}}
\State Log blocked packet and write record
\State Return
\EndIf
\If{packet is TCP or UDP}
\State Determine protocol and payload
\If{YARA rule matches payload}
\State Log detection, add src\_ip to \texttt{blocked\_hosts}, write record
\State Set Timer to unblock src\_ip after 15 minutes
\State Return
\EndIf
\EndIf
\State Determine protocol and write allowed record
\State Allow the packet by sending flow mod
\EndIf
\EndProcedure
\end{algorithmic}
\end{algorithm}
\begin{algorithm}[H]
\caption{Part 3}
\begin{algorithmic}[3]
\State \Comment{launch}
\State \textbf{Function:}
\State Call \texttt{initialize\_csv(csv\_log\_path)}
\State Define \texttt{start\_switch(event)} to log control and create \texttt{PacketLogger}
\State Add listener for \texttt{ConnectionUp} event to \texttt{start\_switch}
\end{algorithmic}
\end{algorithm}
\subsubsection{FlowChart of the Algorithm}
\begin{figure}[httb]
\centering
\includegraphics[width =\textwidth, height = 16cm]{images/mermaid-diagram-2024-05-21-182552.png}
\caption{Flow Chart Diagram of algorithm}
\label{fig:Flow Chart Diagram algorithm}
\end{figure}
\newpage
\subsection{Visual Representation of Result}
\begin{figure*}[htbp]
\centering
\includegraphics[width=\textwidth, height=8cm]{images/Screenshot 2024-05-21 at 01.01.06.png}
\caption{Potential Pattern of Malware packet}
\label{fig:Potential Pattern of Malware packet}
\end{figure*}
\begin{figure*}[htbp]
\centering
\includegraphics[width=\textwidth, height=8cm]{images/Screenshot 2024-05-21 at 02.39.47.png}
\caption{Blocked the host after Running Controller}
\label{fig:Blocked the host after Running Controller}
\end{figure*}
\clearpage
\begin{figure}[htbp]
\centering
\includegraphics{images/Screenshot 2024-05-21 at 17.59.39.png}
\caption{List of Allowed and Blocked IP}
\label{fig:List of Allowed and Blocked IP}
\end{figure}
\clearpage
\newpage
\section*{Chapter 5}
\section{Conclusion}
In this project, we successfully detected and mitigated ransomware-infected hosts or attackers using our Software-Defined Networking (SDN) based Deep Packet Inspection (DPI) method. By leveraging the power of signature-based detection with Regular Expressions (RegEX), we developed an algorithm that effectively identifies and blocks malicious network traffic. Our approach demonstrated the efficacy of combining SDN flexibility with advanced pattern-matching techniques to enhance network security.
\section{Future Scope}
While our current implementation focuses on a single signature pattern for detecting ransomware, there is significant potential for improvement. Future enhancements should aim to incorporate multiple signature patterns to detect a broader range of ransomware variants and other malicious activities. By expanding the algorithm to recognize various threat signatures, we can further strengthen our defense mechanisms. Additionally, integrating machine learning techniques to dynamically update and refine these patterns will ensure that our system adapts to emerging threats, maintaining robust protection against sophisticated cyber-attacks.
\clearpage
\newpage
\phantomsection
\printbibliography
\addcontentsline{toc}{section}{References}
\end{document}Preview
PDF Preview
Create an account to compile and preview