Dual Generative Adversarial Networks Based Unknown Encryption Ransomware Attack Detection

Abstract

Aiming at unknown or variant ransomware attack encrypted with SSL (Secure Sockets Layer)/ TLS (Transport Layer Security) protocol, a detection framework named TGAN-IDS (Transferred Generating Adversarial Network-Intrusion Detection System) based on dual generative adversarial networks is presented in this paper. In this framework, DCGAN (Deep Convolutional Generative Adversarial Network) is adopted to train a generator which has good performance to generate adversarial sample, and is transferred to the generator of TGAN. A pre-training model named PreD is built based on CNN (Convolutional Neural Network), which has good performance to do binary classification, and is transferred to the discriminator of TGAN. The generator and discriminator of TGAN play games in training process until the discriminator has a strong ability to detection unknown attack, and then it is output as an anomaly detector. In order to suppress the deterioration of normal sample detection ability during adversarial training of TGAN, a reconstruction loss function is introduced into the target function of TGAN. Experiments on a mixed dataset which is constructed by CICIDS2017 and other ransomware datasets show comparing with other deep learning network, such as AlexNet, ResNet and DenseNet etc., TGAN-IDS performs well in the indicators of detection accuracy, recall or F1-score etc. Also experiments on KDD99, SWaT and WADI datasets show that TGAN-IDS is suitable for other unencrypted unknown network attack detection.INDEX TERMS Ransomware, encrypted traffic, anomaly detection, GAN, transfer learning.

The Ransomware Epidemic: Recent Cybersecurity Incidents Demystified

“…This initiative provides free decryption tools and supplementary sources of information to ransomware victims to decrypt their files without having to pay a ransom to cybercriminals [28]. The NMR project website hosted at nomoreransom.org is currently sustained by 188 partners worldwide and provides over 100 decryptors that assist victims with 165 different types of ransomware variants to restore their encrypted data and recover their files [29,30]. The Crypto Sheriff tool is available on the NMR website and is intended to help victims of ransomware discover a free decryptor.…”

Ransomware Detection Using Machine Learning: A Review, Research Limitations and Future Directions

“…A different strategy involves detecting ransomware activity before or during transmission before its payload runs on the host. Numerous authors have effectively showcased the success of this approach [74]- [79]. Liu and Patras [74] identify ransomware while it seeks new victims on the network via Server Message Block (SMB) protocol requests on port 445.…”

“…GANs are designed to generate new data instances resembling a given dataset, proving highly valuable in adversarial learning tasks, such as creating scenarios for zero-day attacks where relevant data may be scarce. Several studies in the literature have employed GANs to generate synthetic datasets [79], [118], augmenting real attack patterns due to the evolving nature of ransomware and the custom tactics involved in zero-day attacks. However, despite the recent emphasis on deep learning techniques, it's noteworthy that these approaches tend to be resource-intensive and time-consuming.…”

The Age of Ransomware: A Survey on the Evolution, Taxonomy, and Research Directions

“…The authors showed that their approach can be an effective tool for detecting infection in organizational virtual machines. Zhang et al [31] built a model called PreD for binary classification based on Convolutional Neural Networks. In order to improve the performance of their model, a transfer learning mechanism was employed.…”