A dynamic and static fusion detection method for multiple ransomware based on network traffic analysis

Abstract

The present invention belongs to the field of industrial Internet information security, and provides a dynamic and static fusion detection method for multiple ransomware based on network traffic analysis. In view of the large number of network requests for multiple ransomware and the poor adaptability of traditional methods, a more accurate and comprehensive method is proposed. Through network packet capture tools and traffic monitoring systems, network traffic data is captured and monitored in real time, the data is cleaned and feature extracted, and traffic patterns are analyzed to identify abnormal behavior. Then, the system combines static rules and dynamic detection machine learning models to make a comprehensive judgment on the traffic. When abnormal behavior is detected, the response mechanism is automatically triggered to block malicious traffic and send an alarm. Finally, by continuously optimizing the rule set and model, the accuracy and efficiency of detection are improved to ensure that the system can better respond to intrusion attacks.

Description

Technical Field

[0001] The present invention belongs to the field of industrial Internet information security and relates to a dynamic and static fusion detection method for multiple ransomware based on network traffic analysis. Background Art

[0002] Ransomware is a type of malware that encrypts victims' files or locks their systems in exchange for a ransom. In recent years, these attacks have become increasingly frequent, impacting a wide range of organizations, from individual users to large enterprises and government agencies. Attackers typically demand ransoms in cryptocurrency to avoid tracking. These attacks leverage social engineering and vulnerability exploitation techniques, spreading through phishing emails, malicious attachments, and unsecured network services. Once infected, victims' files are encrypted and a ransom note is typically displayed, demanding payment in exchange for a decryption key. Due to the complexity and diversity of ransomware, traditional defenses often struggle to effectively combat it, necessitating the integration of advanced detection and response strategies for enhanced protection.

[0003] In recent years, a ransomware model known as "multi-ransom" has emerged. This combines multiple threat vectors. First, the attacker encrypts the victim's data, rendering it inaccessible. Next, the attacker steals sensitive information and threatens to publish or sell it unless a ransom is paid. Furthermore, the attacker may launch DDoS attacks or threaten the victim's customers and partners to pressure them into paying the ransom. Through this multi-layered threat and pressure approach, this model significantly increases the attack's success rate and impact on the victim. Traditional ransomware detection methods typically rely on file signatures and system behavior, which can lead to delayed detection and limited signature library updates. This results in poor adaptability, especially for new variants or unknown attacks. Traditional methods are also prone to high false positive rates, especially when dealing with complex or mutating malware. Multi-ransomware attacks generate a large number of network requests, creating an opportunity to identify ransomware attacks through network traffic. Network traffic analysis monitors abnormal traffic and communication behavior to proactively detect virus propagation attempts. By updating machine learning models, the attacker can adapt to changing attack patterns. Dynamic and static fusion, combining real-time traffic analysis with machine learning, can rapidly respond to new threats, reduce false positives through multi-dimensional analysis, and provide more accurate assessments.

[0004] Therefore, the present invention uses network traffic monitoring tools to capture data in real time, static rules to identify known threats, dynamic analysis using machine learning models to detect abnormal behavior, and combined with dynamic and static strategies, the system quickly determines attacks, automatically triggers response mechanisms, and continuously updates models and rule sets to improve detection accuracy and adaptability, thereby achieving comprehensive protection. Summary of the Invention

[0005] This invention aims to provide a fusion dynamic and static detection method for multiple ransomware attacks based on network traffic analysis. By combining traffic characteristics and behavioral analysis, this method can rapidly identify and respond to ransomware attacks. This combined dynamic and static strategy enables the system to effectively detect unknown variants while simultaneously identifying known threats, improving overall monitoring accuracy and efficiency. Compared to traditional methods, this method maintains lower complexity in complex network environments, providing comprehensive protection.

[0006] The technical solutions of the present invention are as follows:

[0007] A dynamic and static fusion detection method for multiple ransomware based on network traffic analysis, the steps are as follows:

[0008] Step 1: Data Collection

[0009] Use the network packet capture tool Wireshark and the traffic monitoring system NetFlow to capture data packets in real time, focusing on monitoring key protocol traffic such as HTTP and DNS. Deploy network probes, configure switch port mirroring, and copy traffic to a network traffic analyzer. These packets contain information such as source and destination addresses, protocol type, port number, and transmission content. This ensures comprehensive capture of network activity and lays the foundation for subsequent analysis.

[0010] Step 2: Data preprocessing and feature extraction

[0011] First, the collected data is de-redundant and cleaned, filtering out duplicate or irrelevant data packets, reducing the data volume, and removing damaged or incomplete data packets to ensure data quality. Key information such as IP addresses and port numbers is then parsed out. When extracting features from the data, traffic patterns are analyzed to identify abnormal traffic surges and suspicious port scanning behavior. The use of non-standard protocols and the characteristics of encrypted traffic are also detected, and traffic is analyzed by calculating the mean, variance, kurtosis, and autocorrelation function of the traffic. Ultimately, the data is stored in secure log files or databases for real-time analysis and model training, enabling rapid response and detection of potential anomalies. Traffic calculations provide the mean, variance, kurtosis, and autocorrelation function of the data.

[0012] Step 3: Dynamic and static fusion detection

[0013] Combining the rapid response of static rules with the in-depth analysis of dynamic detection, comprehensive traffic analysis is performed. Predefined static rule sets are applied to quickly match traffic. These rule sets, based on known attack signatures, identify communications from malicious IP addresses and suspicious domain names, thereby blocking potential threats. Real-time analysis relies on dynamic detection models, using machine learning algorithms such as support vector machines (SVMs) to classify traffic behavior in real time. These models are trained to identify anomalous traffic patterns, such as traffic surges, non-standard port usage, and unusual protocol activity. Z-scores, entropy calculations, SVMs, and cosine similarity are used to monitor network traffic anomalies.

[0014] Step 4: Automated Response

[0015] Once abnormal behavior is detected, the response mechanism is automatically triggered, which can block malicious traffic through firewalls and intrusion detection systems (IDS), isolate infected hosts, send alerts to the security team, automatically perform backup and recovery, and start redundant systems. The automated response ensures that the attack is contained in the initial stage and reduces potential losses.

[0016] Step 5: System Feedback and Optimization

[0017] During real-time analysis, we continuously collect detection results and response data, integrate new data, and regularly update machine learning models. Based on feedback and detection results, we adjust static rules, add newly discovered attack signatures, remove outdated rules, integrate the latest threat intelligence, and update the signature library to enhance the ability to identify new attacks. We regularly evaluate the system's false positive and false negative rates, analyze detection data, optimize model parameters and rule sets, and improve detection accuracy and efficiency. We use the F1-Score function to measure the performance of classification models.

[0018] Beneficial effects of the present invention:

[0019] Real-time data collection and analysis helps identify potential threats early in the attack process, minimizing losses. The dynamic and static fusion detection method combines the rapid response of static rules with the in-depth analysis of dynamic detection. The static rule set, based on known attack signatures, can quickly match and block known threats, while the dynamic detection model, a support vector machine, learns new patterns to identify unknown attacks. This combination not only improves detection accuracy but also significantly reduces false positives. The system rapidly responds and adjusts strategies to further enhance defense capabilities. The system leverages new data and the latest threat intelligence to update both the static rule set and the dynamic detection model, adapting to evolving attack patterns and maintaining efficient detection capabilities, effectively improving detection accuracy and robustness. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1This is a structural diagram of a dynamic and static fusion detection method for multiple ransomware based on network traffic analysis.

[0021] Figure 2 This is a flow chart of a dynamic and static fusion detection method for multiple ransomware based on network traffic analysis.

[0022] Figure 3 It is a structural diagram of data collection.

[0023] Figure 4 It is a flow chart of dynamic and static fusion detection.

[0024] Figure 5 It is a structural diagram of the system's response to intrusion.

[0025] Figure 6 It is a flowchart of system optimization and feedback. DETAILED DESCRIPTION

[0026] The specific implementation of the present invention is further described below in conjunction with the accompanying drawings and technical solutions.

[0027] The present invention is a dynamic and static fusion detection method for multiple ransomware based on network traffic analysis, which aims to analyze network traffic and use the dynamic and static fusion detection method to efficiently and accurately detect the invasion of ransomware viruses, respond in time to block the invasion risk, and finally, continuously provide feedback and optimize the model based on the collected data. Figure 1 and Figure 2 The specific implementation steps are as follows:

[0028] Step 1: Data Collection

[0029] In the protected system of the industrial control system, the network packet capture tool Wireshark and the traffic monitoring system NetFlow are used to capture all data packets in the network. When there is a surge in traffic during a certain period of time, the relevant data packets are monitored and detailed information is recorded. Among them, the traffic of key protocols such as HTTP and DNS should be paid special attention. Through the network probes deployed in the protected system network and the port mirroring function configured on the switch, the obtained network traffic copies are sent to the network traffic analyzer for further analysis. The structural diagram of data collection is shown in the figure below. Figure 3 shown.

[0030] Step 2: Data preprocessing and feature extraction

[0031] The collected network data is then removed from duplicate packets, irrelevant traffic, and damaged or incomplete packets. The packets are then parsed, recording key details such as IP addresses and port numbers. Feature extraction is performed on the processed network data, and the mean, variance, kurtosis, and autocorrelation function of the traffic are calculated. Traffic patterns are then further analyzed to identify abnormal traffic surges and suspicious port scanning behavior. The use of non-standard protocols and features of encrypted traffic are also detected and recorded, and this data is combined for further analysis. Finally, copies of the processed data are securely stored in log files or databases to facilitate subsequent real-time analysis and machine learning model training.

[0032] Perform statistical calculations on network traffic data to obtain relevant data for further analysis:

[0033] (1) The average value μ of the flow rate is:

[0034]

[0035] Where: N is the number of data points, x i is the i-th data point.

[0036] (2) Variance of flow σ 2 for:

[0037]

[0038] (3) Measures the degree of deviation of data from the normal distribution; the kurtosis K of the flow is:

[0039]

[0040] in: is the sample mean, and σ is the sample standard deviation.

[0041] (4) Analyze the flow time series using the autocorrelation function of lag k; the autocorrelation function R(k) of lag k is:

[0042]

[0043] Where: k is the number of lag steps.

[0044] Step 3: Dynamic and static fusion detection

[0045] Analyze the processed data feature information. When abnormal data appears, calculate the Z score, entropy and cosine similarity. If the calculation result indicates that the Z score is far from zero, the entropy value is large or the cosine similarity is low, then combine static rules and dynamic detection to make the next comprehensive evaluation of the traffic. Use predefined static rule sets for fast matching, and identify the communication of malicious IP addresses and suspicious domain names based on known attack characteristics; at the same time, use dynamic detection models for real-time analysis, and use machine learning algorithms such as support vector machines to classify traffic behaviors in real time. When an existing attack is matched according to the static rule set or the result of the support vector machine is greater than the threshold, it indicates that the system has been invaded by ransomware, which requires the next step of protection. The flowchart of dynamic and static fusion detection is as follows: Figure 4 shown.

[0046] Statistical information indicates abnormal network traffic data. The following calculations are performed:

[0047] (1) The Z score is used to represent the traffic statistics and detect the degree of traffic deviation from the normal baseline. The function of the Z score is:

[0048]

[0049] Where: X represents the value of a data point, and σ is the standard deviation of the flow rate.

[0050] (2) Evaluate the randomness of traffic distribution by entropy calculation; the entropy calculation function H(X) is:

[0051]

[0052] Where: p(x i ) is the probability of the i-th data point.

[0053] (3) The machine learning model is used to classify normal and abnormal traffic; the function f(x) of the support vector machine in machine learning is:

[0054]

[0055] Where: α i is the Lagrange multiplier, y i is the label of the i-th sample, K(x i ,x) is the kernel function and b is the bias term.

[0056] (4) Cosine similarity is used to compare the similarity of characteristic flows; the cosine similarity function is:

[0057]

[0058] Where: A and B represent two vectors to be compared, A·B is the dot product of the two vectors, and ||A|| and ||B|| are the moduli of the two vectors.

[0059] Step 4: Automated Response

[0060] After the system is determined to have been invaded through dynamic and static fusion detection, it activates the response mechanism, uses firewalls and intrusion detection systems (IDS) to intercept malicious traffic, isolate infected hosts, and send alerts to the security team. In addition, the system automatically performs backup and recovery and activates redundant systems. The structural diagram of the system's intrusion response is shown below. Figure 5 shown.

[0061] Step 5: System Feedback and Optimization

[0062] The detection results and response data are recorded. The system updates the machine learning model based on these results and data, integrates the new data into the model, adjusts the static rules, adds new discovered attack features, removes outdated rules, incorporates the latest threat intelligence, and updates the feature library. At the same time, the false positive rate and false negative rate are evaluated based on the results, and the detection data is analyzed to optimize the model parameters and rule set. The flowchart of system optimization and feedback is as follows: Figure 6 shown.

[0063] Evaluate system performance for continuous optimization:

[0064] (1) The function FPR for evaluating the false alarm rate is:

[0065]

[0066] Among them: FP is the number of false positives, and TN is the number of correctly identified normal cases.

[0067] (2) The function FNR for evaluating the false negative rate is:

[0068]

[0069] Where: FN is the number of missed detections, and TP is the number of correctly identified attacks.

[0070] (3) The F1-Score function that measures the performance of the classification model is:

[0071]

[0072] Among them: Precision is the accuracy rate, which means the proportion of samples correctly predicted as positive to all samples predicted as positive. Recall is the recall rate, which indicates the proportion of samples correctly predicted to be positive to all samples that are actually positive.

[0073] The lower the false alarm rate and missed alarm rate, the fewer false alarms and missed alarms, the higher the model accuracy, and the stronger the detection capability. The value of the F1-Score function is between 0 and 1. The closer the value is to 1, the better the model performance. In terms of security protection, it is necessary to maximize the precision rate based on the high recall rate.

Claims

1. A dynamic and static fusion detection method for multiple ransomware based on network traffic analysis, characterized by: Here are the steps: Step 1: Data Collection Use network packet capture tools and traffic monitoring systems to capture data packets in real time, monitor HTTP and DNS protocol traffic, deploy network probes, configure switch port mirroring, and copy traffic to a network traffic analyzer; The data packet contains the source and destination addresses, protocol type, port number, and transmission content; Step 2: Data preprocessing and feature extraction The collected network data is then removed from duplicate packets, irrelevant traffic, and damaged or incomplete packets. The data packets are then parsed and the IP address and port number information is recorded. Feature extraction is performed on the processed network data, and the mean, variance, kurtosis, and autocorrelation function of the traffic are statistically calculated. Traffic patterns are then further analyzed to identify abnormal traffic surges and suspicious port scanning behavior. The use of non-standard protocols and features of encrypted traffic are also detected and recorded for further analysis. Finally, a copy of the processed data is securely stored in a log file or database. Step 3: Dynamic and static fusion detection Analyze the processed data feature information. When abnormal data appears, calculate the Z score, entropy and cosine similarity. If the calculation result shows that the Z score is far from zero, the entropy value is large or the cosine similarity is low, then the static rules and dynamic detection are combined to make a comprehensive evaluation of the traffic. Use the predefined static rule set for fast matching to identify the communication between malicious IP addresses and suspicious domain names based on known attack characteristics. At the same time, use the dynamic detection model for real-time analysis and use the machine learning algorithm support vector machine to classify the traffic behavior in real time. When the static rule set matches the existing attack or the support vector machine result is greater than the threshold, it indicates that the system has been invaded by the ransomware virus, and the next step of protection is required. Otherwise, it indicates that the system is normal. Step 4: Automated response Once abnormal behavior is detected, the response mechanism is automatically triggered to block malicious traffic through firewalls and intrusion detection systems, isolate infected hosts, send alerts to the security team, automatically perform backup and recovery, and start redundant systems; Step 5: System Feedback and Optimization During the real-time analysis process, detection results and response data are continuously collected, and the machine learning model is regularly updated using new data integration. Static rules are adjusted based on feedback and detection results, newly discovered attack features are added, outdated rules are removed, the latest threat intelligence is integrated, the feature library is updated, and the ability to identify new attacks is enhanced. The system's false alarm rate and missed alarm rate are regularly evaluated. By analyzing detection data, the model parameters and rule sets are optimized to improve the accuracy and efficiency of detection. The F1-Score function is used to measure the performance indicators of the classification model.

2. According to claim 1, a dynamic and static fusion detection method for multiple ransomware based on network traffic analysis is characterized in that: In step 2, traffic characteristics are counted and time series analysis is performed, as follows: (1) Statistical characteristics of traffic flow; the average value μ of the traffic flow is: Where: N is the number of data points, x i is the i-th data point; (2) Statistical characteristics of traffic flow; the variance of traffic flow σ 2 for: (3) Measures the degree of deviation of data from the normal distribution; the kurtosis K of the flow is: in: is the sample mean, σ is the sample standard deviation; (4) Analyze the flow time series using the autocorrelation function of lag k; the autocorrelation function R(k) of lag k is: Where: k is the number of lag steps.

3. According to claim 1, a dynamic and static fusion detection method for multiple ransomware based on network traffic analysis is characterized in that: In step three, network traffic is detected for abnormality and classified as follows: (1) The Z score is used to represent the traffic statistics and detect the degree of traffic deviation from the normal baseline. The function of the Z score is: Where: X represents the value of a data point, σ is the standard deviation of the flow; (2) Evaluate the randomness of traffic distribution by entropy calculation; the entropy calculation function H(X) is: Where: p(x i ) is the probability of the i-th data point; (3) The machine learning model is used to classify normal and abnormal traffic; the function f(x) of the support vector machine in machine learning is: Where: α i is the Lagrange multiplier, y i is the label of the i-th sample, K(x i ,x) is the kernel function, b is the bias term; (4) Cosine similarity is used to compare the similarity of characteristic flows; the cosine similarity function is: Where: A and B represent two vectors to be compared, A·B is the dot product of the two vectors, and ||A|| and ||B|| are the moduli of the two vectors.

4. According to claim 1, a dynamic and static fusion detection method for multiple ransomware based on network traffic analysis is characterized in that: In step five, evaluate system performance and continuously optimize it, as follows: (1) The function FPR for evaluating the false alarm rate is: Where: FP is the number of false positives, TN is the number of correctly identified normals; (2) The function FNR for evaluating the false negative rate is: Where: FN is the number of missed reports, TP is the number of correctly identified attacks; (3) The F1-Score function that measures the performance of the classification model is: Among them: Precision is the accuracy rate, which means the proportion of samples correctly predicted as positive to all samples predicted as positive. Recall is the recall rate, which indicates the proportion of samples correctly predicted to be positive to all samples that are actually positive.

Images