A Hybrid Framework For Crypto-Ransomware Detection In Enterprise Shared Storage

Technical Summary: A Hybrid Framework For Crypto-Ransomware Detection In Enterprise Shared Storage

Problem Statement
Corporate environments increasingly restrict sensitive data storage on client endpoints, shifting storage to network drives and shared resources via the Server Message Block (SMB) protocol. This architectural shift has expanded the ransomware attack surface from local systems to remote file servers. Traditional endpoint detection mechanisms often fail in this context because they rely on local system behavior; a compromised client can encrypt shared data on a remote server without triggering behavioral alarms on the server itself. Furthermore, existing detection methods face limitations such as dataset bias, lack of reproducibility due to privacy constraints on production traffic, and the inability to detect evasive variants that fragment malicious payloads or operate on Zero-Day vulnerabilities.

Methodology
The authors propose a hybrid detection framework designed for integrated file server and client environments, operating primarily on SMB network traffic (specifically analyzing SMBv2 codes, with equivalents noted for SMBv3). The framework consists of three sequential modules:

1. Per Packet IoC Detection: This initial phase scans individual network packets for known Indicators of Compromise (IoCs). Specifically, it looks for the presence of extortion messages (often dropped as unencrypted files in victim folders) by matching packet lengths against a repository of known ransomware family signatures. If a match is found, immediate remediation is triggered.
2. Per Region of Interest (RoI) IoC Detection: To counter evasive variants that fragment extortion messages across multiple packets, this module aggregates packets into "Regions of Interest" (RoI). An RoI is defined as the sequence of network activities between two consecutive specific control packets (identified as $p_{260}$, a 260-byte packet used for directory enumeration). Within an RoI, the system checks for aggregated patterns of specific "Commands of Interest" ($CoI$) such as file creation ($r_{p410}$), reading ($r_{q171}$), and writing ($r_{p138}$). If the ratio of these aggregated packets matches known IoC patterns, an alarm is raised.
3. Machine Learning (ML) Based Detection: If a packet or RoI does not match known signatures, it is passed to an ML module designed to detect novel or unknown ransomware variants.
   • Feature Engineering: The framework introduces a novel feature extraction technique based on the RoI. It calculates basic features (counts of read, write, open, close operations) and extended features (total, mean, standard deviation, and most frequent values of write data triggered by read or create operations). To ensure environment neutrality, these features are standardized based on the total number of files in the shared drive.
   • Model Training: The system utilizes a Random Committee machine learning model. The training dataset was constructed from 22 ransomware families and 15 benign applications. The benign samples were carefully selected to mimic high-risk user behaviors (e.g., bulk data import, encryption via tools like Hicrypt, compression via 7-Zip) to reduce false positives. The dataset was balanced and processed using 10-fold cross-validation.

Key Contributions

• Region of Interest (RoI) Technique: A new feature engineering method that aggregates network packets based on specific SMB control codes ($p_{260}$) to define context-rich data samples, reducing bias inherent in fixed time-window or flow-based approaches.
• Hybrid Detection Architecture: A framework combining signature-based IoC detection (for known threats) with ML-based anomaly detection (for unknown/evasive threats), integrated into a workflow that allows for early intervention.
• New Datasets: The authors present two new datasets:
  1. A labeled dataset containing 22 ransomware families and 15 benign applications with behavioral similarity to ransomware, designed to minimize bias.
  2. A repository of network-based Indicators of Compromise (IoCs) derived from these families.

Results
Experimental evaluation of the framework yielded the following performance metrics:

• Detection Accuracy: The Random Committee model achieved a detection precision of 99.64%.
• Error Rates: The system demonstrated a 0% False Negative Rate (FNR), ensuring no ransomware intrusions were missed, and a minimal False Positive Rate (FPR) of 0.004%.
• Early Detection: The framework successfully identified ransomware intrusions before significant damage occurred. Using a sliding window of 48 RoIs, the system achieved an early detection accuracy of 99.44%.
• Family-Specific Performance: While models trained on single families (e.g., LockBit2.0) achieved 100% accuracy, the authors note that such narrow models lack robustness. The hybrid framework's strength lies in its ability to generalize across 22 diverse families.

Significance and Claims
The paper claims that this hybrid approach addresses the critical gap in detecting ransomware that targets shared storage rather than just local endpoints. By moving beyond reliance solely on host system state and incorporating network traffic analysis with the novel RoI technique, the framework offers a robust defense against both known and evasive variants. The authors emphasize that the inclusion of benign behaviors that closely mimic ransomware operations (such as legitimate bulk encryption and compression) ensures the detection model is not easily confused by common user actions. The discovery of new network-based IoCs and the provision of reproducible datasets are highlighted as significant contributions to both academic research and industrial cybersecurity defense. The study concludes that while the presented IoCs correspond to unencrypted traffic, the methodology is applicable to encrypted environments (SMBv3) with corresponding code adjustments, offering a scalable solution for enterprise shared storage security.