Skip to content

This is the project on ransomeware detection using machine learning.

Notifications You must be signed in to change notification settings

gau820827/Ransome-killer

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

16 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Ransome-killer

This is the project on ransomware detection using machine learning technique.

In our experiments, malware pcaps were referenced from Malware-traffic-analysis

Requirements

  1. Python 2.7
  2. dpkt
  3. sklearn

Data Sets

We gathered 155 different Ransomwares from Feb.2015 to Sep.2016, and seperated them into 7 main families:

  1. cerber:9
  2. CrypMic:28
  3. Cryptowall:34
  4. CryptXXX:34
  5. Locky:16
  6. Teslacrypt:22
  7. Other:16

We use most three families for experiments: CryptMic, Cryptowall, and CryptXXX

Extract packets

1. Put your ransomware pcap files in malware\_pcap and normal\_pcap
2. Run start.sh to extract http headers from pcap files
Use pcap_Parser -p if you want to parse TCP payloads

Visulization on payloads

We use PCA to reduce dimensions of initial payloads.

python ./visual/pca.py [extracted_data]

It will produced a pickle file, and then use

python ./visual/show.py [pickle_file]

This will show the structure of those payloads.

Examples

Visualization on Cryptmic

Visualization on Cryptmic

Visualization on Cryptwall

Visualization on Cryptwall

Training

After PCA as pre-training, we could use those principle components to fit in different ML models. As an example, we use SVM in sklearn to classify those payloads.

python ./model/svm.py [pickle_file]

The 5-folds cross validation results of Cryptmic are

SVM (C=1, linear kernel)

fold-1: 0.82227159
fold-2: 0.83194444
fold-3: 0.815
fold-4: 0.82361111
fold-5: 0.82272548

Our Results are published on IEICE IA 2016

About

This is the project on ransomeware detection using machine learning.

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published