 ICACT20210191 Slide.01
[Big Slide]
[YouTube] |
Chrome  Click!! |
 |
Hi everybody, my name is Sunjin Lee. For ICACT 2021, I have cooperated with 5 partners from Sungshin University. The topic of this presentation is related to systemic ransomware detection techniques. |
| ICACT20210191 Slide.02
[Big Slide]
|
Chrome Click!! |
 |
The number of cyberattacks is on the rise as it changes to a high-speed network, ultra-low latency, ultra-connected and ultra-intelligent society. One of the most common cyberattacks is ransomware, which is a type of malicious software that infects a computer system, restricts access and demands a ransom. However, existing ransomware detection systems have been difficult to detect ransomware in a complex large-scale system.
A prime example of a ransomware attack is Wannacry in 2017. This attack infected 230,000 computers in 150 countries. Also, ransomware was considered the most damaging attack among malware in 2018, and ransomware damage in 2019 amounted to $11.3 billion. Recently, some ransomware uses obfuscation techniques. In 2021, it is expected to cause about 20 billion dollars in damage.
So, to prevent and respond to the damage that has exponentially increased, systematic ransomware detection technique must be developed that is fast and efficient.
|
| ICACT20210191 Slide.03
[Big Slide]
|
Chrome Click!! |
 |
There is two contribution to this study. First, A new framework is proposed to respond to intelligent ransomware using open source EDR at the network and system level, not at a single terminal or file. Second, the feasibility of the proposed new ransomware response method is proven in the actual system. In short, this paper establishes a new response system that can respond to intelligent ransomware at the network system level rather than a single terminal, and proves that the proposed new ransomware response method is feasible in an actual system. |
| ICACT20210191 Slide.04
[Big Slide]
|
Chrome Click!! |
 |
As ransomware attacks increase and diversify, research on detecting and defending ransomware continues. The first part is digital forensics. Digital forensics is a scientific investigation technique that analyzes digital evidence and uses it for investigation. One of the related studies is “Software-defined networking-based crypto ransomware detection using HTTP traffic characteristics”. This study proposes a network-based detection approach that utilizes the characteristics of ransomware communication by analyzing the sequence of HTTP messages and the content of each message. However, in the case of command and control servers, which are mainly used for malicious attacks, HTTP response sizes are often not considered, so there is a limit to the actual usability. |
| ICACT20210191 Slide.05
[Big Slide]
|
Chrome Click!! |
 |
The second related study is the EDR system. The EDR system is an integrated endpoint security solution that combines real-time continuous monitoring and collection of endpoint data with rules-based automated response and analysis capabilities. Typical examples of EDR tools are GRR and Osquery.
The ‘Threat Hunting Using GRR Rapid Response’ study detects attacks with GRR using vulnerabilities in file transfer protocol servers and Adobe Reader. When an attack was attempted, it was revealed that GRR Hunts could be used to detect abnormal flows of network and memory. However, when detecting attacks, the EDR tool is limited to GRR, so the difference from other analysis tools cannot be known.
In the study “Exploring Osquery, Fleet, and Elastic Stack as an Open-source solution to Endpoint Detection and Response”, Trojans are detected using osquery, fleet, and elastic stack. This study is significant in that it can effectively detect Trojan using osquery, but there is a limitation in that it cannot detect other types of malware since the attack was limited to Trojan.
|
| ICACT20210191 Slide.06
[Big Slide]
|
Chrome Click!! |
 |
Next, I will explain the experimental environment. A client and server were built for ransomware experiments, and the server was deployed in GRR, osquery, and OSSEC environments. The /test directory was created on the client and the files to be infected were configured as shown in the figure below. The CPU version, server and client OS versions, and ransomware RAASNet sources are shown in the table below. |
| ICACT20210191 Slide.07
[Big Slide]
|
Chrome Click!! |
 |
The first experiment is a ransomware detection experiment through GRR. GRR is a Python client installed on the target system, which is a Python server infrastructure that can manage and communicate with agents. GRR is an incident response framework focused on remote live forensics. GRR's File Finder function is used to search the memory space before and after the victim's environment is infected with the ransomware RAASNet, and through this, we can check the file changes. |
| ICACT20210191 Slide.08
[Big Slide]
|
Chrome Click!! |
 |
When RAASNet ransomware is infected in the client's /testt directory, you can check the changes in st size, st blocks, atime, mtime, and ctime as shown in the picture above through GRR File Finder Flow. |
| ICACT20210191 Slide.09
[Big Slide]
|
Chrome Click!! |
 |
The next experiment used Osquery. Osquery is a SQL-based operating system prediction, monitoring and analysis framework that can be used in Linux, macOS, Windows, and FreeBSD. In Osqueryi, you can use queries related to files to monitor files in the memory space infected by the client. The results of the query allow you to detect infection. |
| ICACT20210191 Slide.10
[Big Slide]
|
Chrome Click!! |
 |
After executing the RAASNet ransomware, the query statement “select * from file WHERE path like "/home/path/%";” was performed to check the status list of the files. The file name, atime, mtime, and ctime were changed. |
| ICACT20210191 Slide.11
[Big Slide]
|
Chrome Click!! |
 |
The final experiment is detection of attacks via OSSEC. OSSEC is an open source host-based intrusion detection system and performs log analysis, integrity check, Windows registry monitoring, rootkit detection, real-time warning and active response. Ransomware attacks were detected by using the integrity check function for a specific directory among OSSEC functions, and attacks were detected through monitoring every 30 seconds. |
| ICACT20210191 Slide.12
[Big Slide]
|
Chrome Click!! |
 |
After running RAASNet on a file in the /ttest directory, the changes in the hash values were detected. |
| ICACT20210191 Slide.13
[Big Slide]
|
Chrome Click!! |
 |
This is the conclusion of the study. Cyberattack detection is an essential component of incident response. In this study, we tested whether three types of EDR tools can detect file changes caused by ransomware. Using representative EDR tools, GRR, osquery, and OSSEC, we detected that all files in the /testt directory were encrypted and displayed the results in the form of a notification or log. Through such open source-based threat detection, you can understand when an attack occurred and analyze the attack method. |
| ICACT20210191 Slide.14
[Big Slide]
|
Chrome Click!! |
 |
Finally, Summary and future works. This study used open source endpoint detection and response tools to build and test a framework environment that enables systematic ransomware detection at the network and system level. Experimental results demonstrate that the use of EDR tools can quickly extract ransomware attack features and respond to attacks.
In future work, the efficiency of the EDR tool will be compared by measuring the accuracy and speed with which EDR detects ransomware when EDR is deployed to large clients. We plan to experiment with the evaluation of ransomware detection speed and accuracy by changing the conditions of the ransomware detection method, such as increasing the number of clients or monitoring systems, or changing the size of the target memory space.
|
| ICACT20210191 Slide.15
[Big Slide]
|
Chrome Click!! |
 |
Thanks for your attention. Welcome any comment or question. |
