A ransomware encrypted shared file detection method based on SMB3 traffic characteristics

Abstract

The present application relates to a kind of ransomware encryption shared file detection methods based on SMB3 flow characteristics, belong to ransomware encryption technical field, comprising: obtaining the SMB3 single stream data under the encryption state;Judge whether the read operation number and the write operation number in SMB3 single stream are all greater than minimum effective operation threshold;When read operation number and write operation number are all greater than minimum effective operation threshold, the characteristic index of SMB3 single stream is calculated;When the characteristic index is all within the preset threshold range, send warning.The present application comprehensively uses read-write operation duration, read-write operation ratio, read-write speed, uplink and downlink encrypted data proportion, read-write operation time interval variation coefficient multidimensional characteristic index, from the behavior timing, flow size, transmission law, operation rhythm etc. Angle depicts the typical characteristics of ransomware encryption behavior, can effectively distinguish normal file read-write behavior and malicious encryption behavior, greatly reduce the probability of false alarm, false alarm.

Description

Technical Field

[0001] This invention relates to the field of ransomware encryption technology, specifically to a method for detecting ransomware-encrypted shared files based on SMB3 traffic characteristics. Background Technology

[0002] With the continuous improvement of network informatization, ransomware has become one of the most harmful and widespread types of malware in cyberspace. In recent years, ransomware attacks have shown a trend towards higher frequency, larger scale, and more organized operations. These attacks typically encrypt files on user hosts or network shares, rendering critical business data unusable and causing serious economic losses and security risks to enterprises, institutions, and individual users.

[0003] Existing methods for detecting ransomware encryption of shared network files are mostly based on plaintext communication protocols such as SMB2. They primarily identify abnormal encryption behavior by analyzing changes in file state before and after file read / write operations, the number of file accesses, and plaintext characteristic information. This plaintext characteristic information typically includes the encrypted filename extension and file header. However, with the widespread deployment of the SMB3 protocol in real-world network environments, encrypted mechanisms are now commonly used in shared network communications. File read / write requests and related data in SMB sessions are transmitted in ciphertext, causing detection methods relying on plaintext parsing to become ineffective or significantly less capable in practical applications, making them insufficient to meet the security requirements of complex real-world network environments. Summary of the Invention

[0004] To address the aforementioned problems, the purpose of this invention is to provide a ransomware encrypted shared file detection method based on SMB3 traffic characteristics.

[0005] A ransomware encrypted shared file detection method based on SMB3 traffic characteristics includes:

[0006] Step 1: Obtain SMB3 single-stream data in encrypted state;

[0007] Step 2: Determine whether the number of read operations and the number of write operations in the SMB3 single stream are both greater than the minimum valid operation threshold;

[0008] Step 3: Calculate the characteristic metrics of SMB3 single stream when both the number of read operations and the number of write operations are greater than the minimum effective operation threshold;

[0009] Step 4: Issue an alarm when all feature indicators are within the preset threshold range.

[0010] Preferably, in step 3, the duration of read / write operations, the ratio of write operations to read operations, the read / write rate, the ratio of uplink to downlink encrypted data, the coefficient of variation of the read operation time interval, and the coefficient of variation of the write operation time interval are included.

[0011] Preferably, the formula for calculating the duration of read / write operations is:

[0012]

[0013] in, Duration of read / write operations This refers to the end time of the last Close operation in an SMB3 single stream. This is the start time of the read operation in the SMB3 single stream.

[0014] Preferably, the formula for calculating the ratio of write operations to read operations is:

[0015]

[0016] in, The ratio of write operations to read operations. This represents the number of read operations in a single SMB3 stream. This represents the number of write operations in a single SMB3 stream.

[0017] Preferably, the formula for calculating read / write speed is:

[0018]

[0019] in, For read and write speed, This represents the number of read operations in a single SMB3 stream. This represents the number of write operations in a single SMB3 stream. The duration of the read / write operation.

[0020] Preferably, the formula for calculating the ratio of encrypted uplink to downlink data is:

[0021]

[0022] in, The ratio of encrypted data between uplink and downlink. This refers to the downlink byte size in a single SMB3 stream.

[0023] Preferably, the formula for calculating the coefficient of variation of the read operation time interval is:

[0024]

[0025] in, The coefficient of variation is the time interval between read operations.

[0026] Preferably, the formula for calculating the coefficient of variation of the write operation time interval is:

[0027]

[0028] in, This is the coefficient of variation for the write operation time interval.

[0029] The present invention also provides an electronic device, including a bus, a transceiver, a memory, a processor, and a computer program stored in the memory and executable on the processor. The transceiver, the memory, and the processor are connected via the bus. When the computer program is executed by the processor, it implements the steps in the above-described ransomware encrypted shared file detection method based on SMB3 traffic characteristics.

[0030] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps in the above-described ransomware encrypted shared file detection method based on SMB3 traffic characteristics.

[0031] According to specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0032] This invention relates to a ransomware encrypted shared file detection method based on SMB3 traffic characteristics. Compared with existing technologies, this invention comprehensively adopts multi-dimensional feature indicators such as read / write operation duration, read / write operation ratio, read / write rate, uplink and downlink encrypted data ratio, and read / write operation time interval variation coefficient. It characterizes the typical features of ransomware encryption behavior from the perspectives of behavior timing, traffic scale, transmission patterns, and operation rhythm, which can effectively distinguish between normal file read / write behavior and malicious encryption behavior, and significantly reduce the probability of false negatives and false positives.

[0033] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 This is a schematic diagram of a ransomware encrypted shared file detection method based on SMB3 traffic characteristics provided by the present invention. Detailed Implementation

[0036] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," and "counterclockwise," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0037] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0038] In this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0039] Please see Figure 1 A ransomware encrypted shared file detection method based on SMB3 traffic characteristics, comprising:

[0040] Step 1: Obtain SMB3 single-stream data in encrypted state;

[0041] The length of the SMB3 encrypted payload can be used to deduce the corresponding SMB2 protocol messages such as Read Request, Write Response, Close Response, and GetInfoRequest.

[0042] Based on the derived SMB2 protocol message, the following features can be extracted from the SMB3 single stream:

[0043] Table 1 SMB3 Single Stream Characteristics

[0044] Feature Name Feature Description Extraction method SMB3ReadOperationCount SMB3 single-stream read operation count Number of Read Requests in SMB3 Single Stream SMB3WriteOperationCount Number of write operations in SMB3 single stream Number of Write Responses in SMB3 Single Stream SMB3BytesDown SMB3 single-stream downlink byte size SMB3 single-stream downlink Encrypted SMB3 Data bytes total SMB3BytesUp Uplink byte size in SMB3 single stream Total number of uplink Encrypted SMB3 Data bytes in a single SMB3 stream SMB3ReadOpeartionStartTime SMB3 single-stream read operation start time Time of the first Read Request operation in SMB3 single stream SMB3CloseOperationEndTime The end time of the last Close operation in SMB3 single stream The time of the last Close Response operation in SMB3 single stream SMB3FileCount Number of files in SMB3 single stream Number of GetInfoRequest requests in SMB3 single stream SMB3ReadOperationTimeInterval SMB3 single-stream read operation time interval Time interval of Read Request in SMB3 single stream SMB3WriteOperationTimeInterval Write operation time interval in SMB3 single stream Time interval for Write Response in SMB3 single stream

[0045] Step 2: Determine whether the number of read operations and the number of write operations in the SMB3 single stream are both greater than the minimum valid operation threshold;

[0046] Step 3: Calculate the characteristic metrics of SMB3 single stream when both the number of read operations and the number of write operations are greater than the minimum effective operation threshold;

[0047] In step 3, the duration of the read / write operation is calculated. Calculate the ratio of write operations to read operations. Calculate read and write speeds. Calculate the ratio of encrypted data between uplink and downlink. Calculate the coefficient of variation of the read operation time interval. Calculate the coefficient of variation of the write operation time interval. .

[0048] Step 4: Issue an alarm when all feature indicators are within the preset threshold range.

[0049] judge Determine whether it is between [threshold B, threshold C]. Determine whether it is between [threshold D, threshold E]. Determine whether it is between [threshold F, threshold G]. Determine whether it is greater than the threshold H. Is it less than the threshold I? Is it less than the threshold J? If all conditions are met, an alarm should be triggered.

[0050] The process of the present invention will be further described below with reference to specific embodiments:

[0051] Select 100 ransomware families (such as Safepay, LockBit, etc.) and simulate their behavior of encrypting shared folders in bulk within a virtual machine. Enable Windows SMB3 encryption and capture complete network traffic before and after encryption.

[0052] Perform the following parsing and statistical calculations on each SMB3 encrypted traffic:

[0053] Count the number of read operations ( ) and number of write operations ( );

[0054] Count the number of files in a single stream ;

[0055] Calculate the read / write operation ratio: ;

[0056] Calculate read / write operation speed: ;

[0057] Calculate the ratio of encrypted data bytes between uplink and downlink: ;

[0058] Calculate the coefficient of variation of the read operation time interval. ;

[0059] Calculate the coefficient of variation of the write operation time interval. .

[0060] Distributions were constructed for each characteristic indicator of the aforementioned 100 ransomware families, and the threshold range was determined using the percentile method to ensure coverage of more than 90% of the ransomware family samples.

[0061] For range-based thresholds (such as [B, C], [D, E], [F, G]): take the 5th percentile of the corresponding indicator as the lower threshold and the 95th percentile as the upper threshold.

[0062] For lower limit thresholds (e.g., number of operations > A), > H): Take the 5th percentile of the minimum distribution of read and write operations as the threshold A.

[0063] For upper bound thresholds (such as CV < I, CV < J): take the 95th percentile of the corresponding CV distribution as the upper bound threshold.

[0064] This invention comprehensively employs multi-dimensional feature indicators such as read / write operation duration, read / write operation ratio, read / write rate, uplink / downlink encrypted data ratio, and read / write operation time interval variation coefficient to characterize the typical features of ransomware encryption behavior from the perspectives of behavior timing, traffic scale, transmission patterns, and operation rhythm. It can effectively distinguish between normal file read / write behavior and malicious encryption behavior, and significantly reduce the probability of false negatives and false positives.

[0065] The present invention also provides an electronic device, including a bus, a transceiver, a memory, a processor, and a computer program stored in the memory and executable on the processor. The transceiver, the memory, and the processor are connected via the bus. When the computer program is executed by the processor, it implements the steps in the above-described ransomware encrypted shared file detection method based on SMB3 traffic characteristics. Compared with the prior art, the beneficial effects of the electronic device provided by the present invention are the same as those of the ransomware encrypted shared file detection method based on SMB3 traffic characteristics described above, and will not be repeated here.

[0066] The present invention also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it implements the steps in the above-described ransomware encrypted shared file detection method based on SMB3 traffic characteristics. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present invention are the same as the beneficial effects of the ransomware encrypted shared file detection method based on SMB3 traffic characteristics described above, and will not be repeated here.

[0067] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A ransomware encrypted shared file detection method based on SMB3 traffic characteristics, characterized in that, include: Step 1: Obtain SMB3 single-stream data in encrypted state; Step 2: Determine whether the number of read operations and the number of write operations in the SMB3 single stream are both greater than the minimum valid operation threshold; Step 3: Calculate the characteristic metrics of SMB3 single stream when both the number of read operations and the number of write operations are greater than the minimum effective operation threshold; Step 4: Issue an alarm when all feature indicators are within the preset threshold range.

2. The ransomware encrypted shared file detection method based on SMB3 traffic characteristics according to claim 1, characterized in that, In step 3, the duration of read / write operations, the ratio of write operations to read operations, the read / write rate, the ratio of uplink to downlink encrypted data, the coefficient of variation of the read operation time interval, and the coefficient of variation of the write operation time interval are all considered.

3. The ransomware encrypted shared file detection method based on SMB3 traffic characteristics according to claim 2, characterized in that, The formula for calculating the duration of read / write operations is: in, Duration of read / write operations This refers to the end time of the last Close operation in an SMB3 single stream. This is the start time of the read operation in the SMB3 single stream.

4. The ransomware encrypted shared file detection method based on SMB3 traffic characteristics according to claim 2, characterized in that, The formula for calculating the ratio of write operations to read operations is: in, The ratio of write operations to read operations. This represents the number of read operations in a single SMB3 stream. This represents the number of write operations in a single SMB3 stream.

5. The ransomware encrypted shared file detection method based on SMB3 traffic characteristics according to claim 2, characterized in that, The formula for calculating read / write speed is: in, For read and write speed, This represents the number of read operations in a single SMB3 stream. This represents the number of write operations in a single SMB3 stream. The duration of the read / write operation.

6. The ransomware encrypted shared file detection method based on SMB3 traffic characteristics according to claim 2, characterized in that, The formula for calculating the ratio of encrypted data between uplink and downlink is: in, The ratio of encrypted data between uplink and downlink. This refers to the downlink byte size in a single SMB3 stream.

7. The ransomware encrypted shared file detection method based on SMB3 traffic characteristics according to claim 2, characterized in that, The formula for calculating the coefficient of variation of the read operation time interval is: in, The coefficient of variation is the time interval between read operations.

8. A ransomware encrypted shared file detection method based on SMB3 traffic characteristics according to claim 2, characterized in that, The formula for calculating the coefficient of variation of the write operation time interval is: in, This is the coefficient of variation for the write operation time interval.

9. An electronic device comprising a bus, a transceiver, a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the transceiver, the memory, and the processor are connected via the bus, characterized in that, When the computer program is executed by the processor, it implements the steps in the ransomware encrypted shared file detection method based on SMB3 traffic characteristics as described in any one of claims 1-8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps in the ransomware encrypted shared file detection method based on SMB3 traffic characteristics as described in any one of claims 1-8.

Images