Ransomware Encrypted Your Files but You Restored Them from Network Traffic

Abstract

In a scenario where user files are stored in a network shared volume, a single computer infected by ransomware could encrypt the whole set of shared files, with a large impact on user productivity. On the other hand, medium and large companies maintain hardware or software probes that monitor the traffic in critical network links, in order to evaluate service performance, detect security breaches, account for network or service usage, etc. In this paper we suggest using the monitoring capabilities in one of these tools in order to keep a trace of the traffic between the users and the file server. Once the ransomware is detected, the lost files can be recovered from the traffic trace. This includes any user modifications posterior to the last snapshot of periodic backups. The paper explains the problems faced by the monitoring tool, which is neither the client nor the server of the file sharing operations. It also describes the data structures in order to process the actions of users that could be simultaneously working on the same file. A proof of concept software implementation was capable of successfully recovering the files encrypted by 18 different ransomware families.

Crypto-ransomware detection using machine learning models in file-sharing network scenarios with encrypted traffic

“…We can also offer file recovery using the network-based analysis probe but only in case of the file-sharing protocol being not encrypted. Non-encrypted protocols are for example versions 1 and 2 of SMB, and we showed a proof-of-concept of the file-recovery feature in a previous publication (Berrueta et al, 2018). Moussaileb et al (2018) monitored the file system traversal paths and velocity of the analysed programs.…”

High-Speed Analysis of SMB2 File Sharing Traffic without TCP Stream Reconstruction

“…We have validated the implementation of stream reconstruction software and the SMB message dissection procedure creating an extension of this module capable of extracting the content of files transferred using SMB [10].…”

Analyzing Data Theft Ransomware Traffic Patterns Using BERT

“…In light of these evolving ransomware techniques, traditional cybersecurity measures focusing solely on preventing access breaches have become inadequate [11,18,19]. The need for advanced analytical tools capable of detecting and interpreting complex and subtle patterns of network traffic indicative of ransomware activities has become more critical [15,20,21]. Here, the Bidirectional Encoder Representations from Transformers (BERT) model emerges as a potent tool [22,23].…”