A Hybrid Framework For Crypto-Ransomware Detection In Enterprise Shared Storage⋆ Gervais Hatungimanaa,∗ , Abdun Naser Mahmoodb and Mohammad Jabed Morshed Chowdhuryc
arXiv:2606.30586v1 [cs.CR] 29 Jun 2026
a Department of Computer Science and Information Technology, La Trobe University, Melbourne, VIC, Australia
ARTICLE INFO
ABSTRACT
Keywords: Ransomware detection network traffic analysis Indicators of Compromise machine learning early detection evasive ransomware endpoint protection intrusion detection cybersecurity
Most corporate workplace environments enforce policies and technical controls that limit the storage of sensitive data on client endpoints. Consequently, ransomware operators have evolved variants that expand their attack surface from local systems to network drives and shared storage resources. As traditional endpoint detection mechanisms focus primarily on local system behaviour, a compromised client can impact remote file servers, such as by encrypting shared data, without directly triggering behavioural changes on the servers themselves. In this paper, we propose a hybrid detection framework for detecting crypto-ransomware intrusion within integrated file server and client environments. The framework is based on a new technique referred to as Region of Interest (RoI) to analyse network traffic and extract Indicators of Compromise (IoCs). The IoC repository serves as an additional ruleset to enhance existing security tools such as EDRs and IDSs, while RoI-derived features are used to train an ML model to detect highly evasive variants. This study incorporates a broader set of ransomware families and carefully selected benign behaviours based on domain expertise, ensuring coverage of common user actions that could interfere with ransomware detection. Beyond IoCs, which operate in a signature-based manner, our machine learning module achieves a detection precision of 99.64%, with a 0% false negative rate (FNR) and a minimal false positive rate (FPR). Furthermore, the proposed method enables early detection, identifying ransomware intrusions before significant damage occurs, achieving an accuracy of 99.44%.
[email protected] (G. Hatungimana)
social engineering techniques used by cybercriminals. Electronic strategies, on the other hand, involve the deployment of specialized software on target endpoints to prevent the successful execution of ransomware or other forms of malware. So far, electronic methods have proven to be the most reliable defence against ransomware attacks. However, the software tools currently used to detect ransomware often fall short of expectations, particularly due to the novel and advanced techniques employed by cybercriminals, which lead to Zero-Day attacks. To mitigate the challenges posed by zero-day vulnerabilities, numerous scholarly articles, such as those presented in 1, suggest leveraging the power of Machine Learning (ML) to enhance the effectiveness of existing detection tools. In addition to Zero-Day attacks, ransomware operators have increasingly adopted advanced techniques and hacking practices to compromise their targets and ensure the successful execution of ransomware payloads. This practice is commonly referred to as "evasion.". To counter these evolving threats, it is recommended that detection tools be enhanced to identify incidents without relying solely on the host system’s state. One potential approach is to expand the scope of detection by incorporating other sources of information, such as network traffic, which can provide additional insight into the attack. Most corporate workplace environments enforce policies and technical controls that limit the storage of sensitive data on client endpoints. One of the widely used techniques used for file sharing in the Windows environment is the Server Message Block (SMB) protocol.
First Author et al.: Preprint submitted to Elsevier
Page 1 of 12
1. Introduction Although ransomware is often considered a recent phenomenon in cybersecurity, the concept of taking computer data hostage dates back to 1989 with the creation of the AIDS Trojan. Developed by Dr Joseph Popp, an evolutionary biologist and Harvard University alumnus, the Trojan was distributed following the World Health Organisation (WHO) AIDS conference in Stockholm. Popp sent infected floppy disks by mail to conference attendees, marking one of the first known instances of malicious software designed to extort individuals for financial gain. Victims of the AIDS Trojan were initially asked to pay approximately $189 to regain access to their encrypted data [15]. Since then, new variants and ransomware families have emerged each year, evolving in both complexity and impact. Unlike traditional computer viruses, ransomware typically does not cause permanent damage to the operating system. However, it can disable certain system services, often rendering it unusable until the victim pays the ransom. One of the most prevalent types of ransomware is crypto-ransomware, which encrypts the victim’s data and demands payment in exchange for the decryption key. From a destructive standpoint, cryptoransomware remains one of the most significant threats due to its ability to lock critical data. The strategies to combat ransomware attacks involve a combination of electronic and non-electronic methods. Non-electronic strategies primarily focus on educating users about cybersecurity threats, with a particular emphasis on ∗ Corresponding author
ORCID (s):
A Hybrid Framework For Crypto-Ransomware Detection In Enterprise Shared Storage
SMB was developed in 1983 to enable file sharing between computers on a network, allowing remote devices (servers) to make files accessible to clients over a TCP/IP connection. Since its inception, SMB has undergone several improvements. SMBv1 was implemented with Windows Server 2003 but was found to be vulnerable to the EternalBlue exploit and was subsequently deprecated in 2003. SMBv2 replaced SMBv1 in Windows Server 2008 and Windows Vista, and is still widely used despite being susceptible to eavesdropping vulnerabilities because as all messages exchanged between the server and the client are transmitted in plain text. The latest version, SMBv3, supports data encryption to address these security concerns. Both SMBv2 and SMBv3 are still supported and actively used. [13]. For instance, contemporary Microsoft operating systems, including Windows 10, Windows 11, and Windows Server versions such as 2019, 2022, and 2025, enable SMBv2 and later versions by default and negotiate the highest mutually supported SMB dialect during communication. In addition to general-purpose IT systems, SMBv2 is commonly encountered in legacy and constrained environments, including Internet of Things (IoT) and Operational Technology (OT) systems, where long device lifecycles, vendor dependencies, and limited firmware update capabilities often delay adoption of newer SMB dialects. SMBv2 is also widely implemented in non-Windows platforms, such as Samba-based systems and network-attached storage devices, enabling interoperability across heterogeneous networks. SMB data consists of commands initiated by the client to access and manipulate remote files hosted on a remote server. The SMB data structure includes various headers that carry different commands [10]. As data move through the layers of the OSI model [6], they undergo an encapsulation process. As depicted in Fig.1, the SMB data is passed to the transport layer, where it is divided into smaller chunks, known as segments or streams, based on the maximum number of bytes that can be transmitted at once. The size of these segments is determined through a negotiation process governed by TCP standards. At the transport layer, the TCP header is added to each segment, which is then passed to the network layer. The network layer adds IP addresses to the segment, ensuring that they can be routed across the network. At this point, the segment is called a packet, which is forwarded to the data link layer for final delivery. A typical use case for this protocol is an environment consisting of a File Server and multiple Client PCs. Client PCs access files hosted on the File Server via mapped network drives. In this paper, we propose a hybrid detection framework for detecting crypto-ransomware intrusion within enterprise Shared Storage. This approach improves detection accuracy and robustness and enables timely alerts in the earliest stages of the attack, thus enhancing the overall response to ransomware threats.
Figure 1: SMB Encapsulation
While research on ransomware detection in file-share environments is not new, previous studies still have several limitations, such as: • Risk of dataset and environmental bias: The inclusion of real-user traffic as a benign baseline does not guarantee environment neutrality. User behaviour is strongly influenced by organisational context, system usage patterns, and access controls, which may limit the comparability of benign and malicious traffic across different environments. Furthermore, there is no assurance that legitimate user activity within the observed environment is capable of generating behavioural patterns comparable to ransomware operations, particularly with respect to file access rates, directory traversal, and network share interactions. Consequently, the detection model may capture environmentspecific workload characteristics rather than invariant indicators of ransomware behaviour. • Limited reproducibility and comparability: Network traffic collected from real production environments is typically subject to privacy and confidentiality constraints and is therefore unlikely to be shared. The unavailability of such datasets limits the ability of other researchers to reproduce the results, independently evaluate the proposed technique, or perform fair comparisons with alternative approaches. • Partial Dataset: The lack of datasets containing both malicious and benign samples remains a significant challenge for ransomware detection research. A comparison of existing scholarly articles and our approach is summarised in Tab.1. The limitations identified in previous research and the reasons why this study is necessary can generally be grouped as follows:
1.1. Contributions In this sub-section, we highlight our contributions towards addressing issues as previously discussed. 1. A new feature engineering technique referred to as the Region of Interest (RoI). While numerous scholarly
First Author et al.: Preprint submitted to Elsevier
Page 2 of 12
A Hybrid Framework For Crypto-Ransomware Detection In Enterprise Shared Storage Table 1 Comparison of our design and closely related works
Features Engineering Techniques
IoC-based Detection
[2] [8] Ours
DESIGN Technique
Work
Threshold ML ML
1 Sec. Window 1 Sec. Window RoI
# # !
articles rely on flow-based approaches [14] and time window methodologies, each of these approaches has its inherent limitations, as outlined earlier in this section. The RoI technique mitigates these limitations by using clear demarcation codes to define specific data samples, thus reducing the potential for bias in design. This method is both simple and reproducible, enabling more effective comparisons of results across various studies. 2. A new hybrid framework combining machine learning (ML) techniques with Indicators of Compromise (IoCs) to detect known and unknown ransomware at an early stage. The framework integrates newly discovered network-based IoCs with network perimeter devices to enhance ransomware detection capabilities. Experimental results demonstrate that the machine learning model is capable of identifying unknown ransomware with high accuracy and a low false negative rate. The synergy between these components provides a robust tool for mitigating ransomware attacks, offering significant potential to improve cybersecurity defences. 3. We present two new datasets to advance ransomware detection. The first supports machine learning, covering 22 ransomware families and 15 benign apps selected for behavioural similarity to ransomware to reduce bias. The second contains ransomware Indicators of Compromise (IoCs) from these families. These datasets offer value to both research and industry.
Environment Neutral
Reproducibility
Full Dataset
# # !
# # !
# # !
of files followed by immediate writing of encrypted content. REDFISH raises an alarm when a predefined number of file deletions (𝑁) occur within a short time window (𝑇 ) and the average read/write throughput exceeds a threshold (𝑉thres ). By correlating these events in real time, the algorithm identifies ransomware activity before significant data loss occurs, without requiring any software on the endpoints. A significant limitation of the REDFISH algorithm is that it requires parsing all network traffic to extract file paths and SMB commands, which can introduce substantial computational overhead, particularly in high-throughput networks. Furthermore, the algorithm assumes certain file and directory structures in the shared environment; variations in organisational layouts or folder hierarchies may impact the accuracy of early detection. Additionally, the method relies on visibility of file-sharing traffic, so encrypted or obfuscated SMB sessions could hinder its effectiveness. A Machine Learning (ML) model was recently proposed in [8]. E.Berrueta et al. (2022) extended SMB traffic with a focus on the newer SMBv3 protocol. The study correlates TCP packets exchanged between the client and server with ransomware-related file operations, including read, write, and other command activities. These events are aggregated within one-second time windows, resulting in dataset features that represent the accumulated byte volumes across different time intervals. While different ML model been tested with different time intervals, Neural Networks (NE) maintains the accuracy over 99%.
3. Proposed Method 2. Related Works In this section, we review various techniques proposed in previous scholarly articles for ransomware detection in a file-server environment. The REDFISH algorithm was proposed in [2]. Morato et al. analysed the SMBv2 protocol in network traffic to design a ransomware detection algorithm in file-sharing environments. The study involved 50 samples from 19 ransomware families. The algorithm detects ransomware activity early by analysing file-sharing network traffic, specifically SMB operations on shared directories. It monitors the sequence and timing of file read, write, and deletion operations, looking for patterns characteristic of ransomware, such as rapid reading First Author et al.: Preprint submitted to Elsevier
Based on gaps towards ransomware detection as discussed previously, this section presents details about the Hybrid framework for detecting crypto ransomware in a file share environment. The framework heavily relies on packet codes referred to as packets of interest (𝑃 𝑜𝐼) and Indicators of compromise (𝐼𝑜𝐶). We extracted codes for encrypted (SMBv3) and nonencrypted (SMBv2) environments. However, in order to maintain paper conciseness, we present the framework using SMBv2 codes. We keep equivalent codes for SMBv3 in a separate IoC dataset. The main modules of this framework include Per Packet IoC Detection, Per RoI Detection and ML-Based detection. Page 3 of 12
A Hybrid Framework For Crypto-Ransomware Detection In Enterprise Shared Storage
Figure 2: Hybrid Detection Framework
As depicted in Fig.2, the combination of these components enables early detection, automatic remediation, and effective incident management. The system inspects each network packet for well-known behaviours using IoC. If the packet matches any IoC, indicating a known attack, the system immediately triggers automatic remediation, halting further processing. If the packet does not contain any IoC, it is then passed through the Region of Interest (RoI) process. This method analyses the packet’s context and behaviour to identify suspicious activity or unknown attack patterns. If RoI analysis identifies the packet as malicious, the system alerts the Security Operations Centre (SOC) team for further investigation and response.
3.1. Per Packet IoC Based Detection Phase This module scans individual packets against known indicators, such as the presence of extortion message drops, and initiates immediate remediation upon detecting a match. The ransomware must inform the victim about the damage and provide instructions on how to make payments(extortion). The commonly used way to do that is by dropping extortion messages in one or more folders on the victim’s device. It is the only file that does not get encrypted. The length or size of such a file depends on the information it contains; it is different from family to family. Since each family has a First Author et al.: Preprint submitted to Elsevier
unique message size, it becomes an Indicator of Compromise (IoC) for well-known ransomware families. In experimentation, the message size can be manually depicted through the file properties and then stored in the 𝐼𝑜𝐶 repository for reference during live traffic inspection. Some characteristics of such files we found so far include: • It appears once in one folder • It is always a result of 𝐶410, a newly created file • It is the same size across all folders • It can be split into small chunks to evade detection We use the procedure in algorithm 1 to inspect the network packet. For each network packet subsequent to the SMBv2 packet of length 410, if the packet length value matches any 𝐼𝑜𝐶 that we collected, that packet is malicious, and an alarm or corrective action is triggered. If nothing is matched, that packet proceeds to the next phase.
3.2. Per RoI, IoC Based Detection Phase Certain variants of evasive ransomware attempt to conceal their extortion messages by fragmenting them into multiple packets. When individual packets fail to match Page 4 of 12
A Hybrid Framework For Crypto-Ransomware Detection In Enterprise Shared Storage
Algorithm 1 Per Packet 𝐼𝑜𝐶 Based Detection Procedure 1: Let 𝑃𝑖 = 𝐹 𝑜𝑟𝑤𝑎𝑟𝑑 𝑝𝑎𝑐𝑘𝑒𝑡 2: Let 𝑙 = 𝑃𝑖 𝑙𝑒𝑛𝑔𝑡ℎ ℎ𝑒𝑎𝑑𝑒𝑟 3: for each 𝑃𝑖 [𝑙] do 4: 𝐼𝑓 (𝜃𝑃𝑖 [𝑙] ∈ 𝐼𝑜𝐶) 5: 𝑃𝑖 == 𝑀𝑎𝑙𝑖𝑐𝑖𝑜𝑢𝑠 6: end if 7: end for
indicators of compromise (IoCs) in earlier modules, the system employs Region of Interest (RoI) techniques to identify potential ransomware extortion message drops that may have been fragmented as an evasion tactic. The details about extracting 𝑅𝑜𝐼 are explained in section 4.2.1. As depicted in algorithm 2, for each unique value of the Length feature in 𝑅𝑜𝐼 forward packets, if the ratio between the sum of all packets with the same length value and itself matches any 𝐼𝑜𝐶, then 𝑅𝑜𝐼 is malicious and alarm or correction action is triggered. If nothing is matched, the 𝑅𝑜𝐼 proceeds to the last checkpoint via Machine Learning. Algorithm 2 Per 𝑅𝑜𝐼 𝐼𝑜𝐶 Based Detection Procedure Require: 𝐹 𝑜𝐼 ⊂ 𝑅𝑜𝐼; A Set of forward packets flow after 𝑟𝑝410 packet 1: Let 𝑅𝑜𝐼 [𝑙] = {𝑙𝑖 }, 𝑤ℎ𝑒𝑟𝑒 𝑖 ∈ {1, ..., 𝑛}; 𝑛 == ∀𝑅𝑜𝐼 and 𝑙 == Length feature value 2: for each 𝑙𝑖 ∈ 𝑅𝑜𝐼 do ∑ ( 𝜃𝑙 ) 3: 𝐼𝑓 ( 𝜃𝑙 𝑖 ∈ 𝐼𝑜𝐶) Then 𝑖 4: 𝑅𝑜𝐼 = 𝑀𝑎𝑙𝑖𝑐𝑖𝑜𝑢𝑠 5: end if 6: end for
3.3. ML-Based Detection Phase This module is used to detect novel ransomware variants by analysing Region of Interest (RoI) packets for anomalous behaviours that deviate from established patterns. These behaviours may include the presence of encrypted data or irregular access to shared files, which are indicative of potential ransomware activity. Machine learning (ML) plays a pivotal role in artificial intelligence (AI) by enabling computers to mimic human thinking. ML involves various algorithms that classify data using techniques such as strata, probability, or decision trees. Each ML technique employs multiple methods to capture and manipulate patterns within existing data, allowing for the classification of unseen data. Well-known examples of these methods include Support Vector Machines (SVM), Neural Networks, Logistic Regression, Discriminant Analysis, Random Forests, Linear Regression, Naïve Bayes, Knearest neighbours, and Decision Trees. Notably, Neural Networks have evolved into an independent field known as Deep Learning, which has garnered significant attention in AI research. The choice of which ML technique or method to use depends on the nature and complexity of the data being analysed. First Author et al.: Preprint submitted to Elsevier
A common characteristic across all ML methods is their reliance on a benchmark dataset, which serves as the basis for training the algorithms. Once a benchmark dataset is established, the next critical step is feature selection, which involves determining which data patterns should be used to train the model. This step marks a key distinction between traditional machine learning and deep learning, particularly when dealing with large datasets. In traditional ML, human intervention is often required to select the most relevant features for training. In contrast, deep learning models, particularly neural networks, can autonomously identify which features are most relevant, minimising the need for manual feature selection. In this framework, we use Random Committee Machine Learning Model. The decision of this Random Committee over other ML techniques is after experimentation results as discussed in section 6.
4. Experimentation In this section, we present the techniques used for carrying out the experimentation, including sample sources, execution, capturing network traces, and processing.
4.1. Dataset E.Berrueta [3] developed and published a public data repository containing the results of executing over 70 ransomware samples collected between 2015-2020 from different families. The repository includes network traffic captures (DNS and TCP) and file Input/Output (I/O) operations generated by each sample during its activity, including the read and written bytes, the time between open operations, the number of deletions, and the file sizes. The repository comprises ransomware families collected between 2015 and 2020. While valuable for benchmarking and reproducibility, it may not capture the behaviour of more recent ransomware strains and evolving attack techniques. Therefore, the development of updated datasets remains necessary to support contemporary studies and the evaluation of modern detection approaches. We started building a testbed where we execute samples safely. As depicted in Fig. 3, we set up a client on a 64-bit Windows 10 Professional virtual machine with specs: 8 GB of memory, and 100 GB of SSD. The user does not have domain or local administrative rights. The user accesses the data folder through the mapped network drive. The other client PCs are for illustration purposes only and have not been used anywhere in a lab. We set up a Windows 2016 virtual machine as a file server with specs: 8 GB of memory and 100 GB. The file server has been set up with a data folder of 200 files in 8 sub-folders. The root folder is shared with default read and write permissions, and the server is also acting as a domain controller and DNS. The monitoring PC is a 64-bit Ubuntu 24 Virtual Machine with 8 GB of memory and 50 GB of disk. All the virtual machines run on a 64-bit Ubuntu 24 host with specs: AMD RYZEN 5000 7 processor, 32 GB memory and 500 GB SSD and are connected to a virtual switch. The port Page 5 of 12
A Hybrid Framework For Crypto-Ransomware Detection In Enterprise Shared Storage
Figure 3: Implementation Scenario
where the Monitoring VM is connected has been configured in promiscuous mode to listen to packets between Client01 and the File Server. Behind the scenes, the host is connected to the WatchGuard Firewall, which continuously logs network access activities.
4.1.1. Ransomware Sample There are multiple publicly available sources of malware samples, including VirusShare, AnyRun, Malware Bazaar, etc. In order to download a sample, one must know the signature (usually hash values) of that malware. We searched multiple cybersecurity companies’reports for trending ransomware attacks and related indicators of compromise (IoC) in order to get malware hashes. We realised that the most recent ransomware strains’ IoCs cannot be found anywhere other than in Virustotal. Unfortunately, downloading samples from VirusTotal is not possible unless someone has a premium subscription, which costs about 600 euros monthly. So, if any IoC cannot be found in other places, it is dropped. We execute samples one by one in our testbed while capturing network traces between the client and file server for 10 minutes; a sample that does not encrypt the data folder is removed from the list (out of scope) because it might be human-operated ransomware, which requires manual operation via C2C. The final list of ransomware families covered in this work is presented in Table 3.
First Author et al.: Preprint submitted to Elsevier
4.1.2. Benign Sample In a previous work, there are a few papers with details on the acquisition of benign samples. For example, Edwardo et al [8] created benign samples by intercepting network traffic in a real production environment. Fernando et al [9] used VeraCrypt, AxCrypt, BitLocker and 7-Zip for benign. For our method, we used an extensive approach for generating benign samples. We try to mimic most of the possible normal user actions, which causes behaviour closer to that of ransomware, as explained below and presented in Table 3. 1. Data Encryption. Practically, in a production environment where users access centrally hosted file servers, it is rare and unsafe to allow users to encrypt their data. The IT department would rather deploy such tools on the file server; that is why most commercial encryption tools are limited to local and extended disk partitions. However, there are a few tools that users can still use to encrypt data if required. Hicrypt; We searched and found that Hicrypt is one of the few tools that can encrypt files on a network share. This tool allows a user to create an empty folder within a network share and then encrypt it. All new files which will be added to that folder later will get encrypted automatically. So we empty our network drive and encrypt it using Hicrypt , then we import it into the same data folder while capturing network packets. Page 6 of 12
A Hybrid Framework For Crypto-Ransomware Detection In Enterprise Shared Storage Table 3 Benign Samples
Table 2 Ransomware Samples Ransomware Group ako Coronavirus netwalker Avoslocker Hive ragnarok Clop Darkside Wannacry CryptoLocker alpha backcat mountlocker Conti neffilim nemity DoppelPaymer ransomexx Revil/Sodinokibi lockbit2.0 maze lockbit3.0
Number of RoI 8 8 41 48 49 55 56 58 62 78 79 81 81 87 87 87 88 92 110 121 121 133
Windows Encrypt Utility; Windows Encryption Utility can encrypt both local and network files. Though rarely allowed in a production environment, we decided to capture the behaviour of this action so that if it happens for some reason, our detection model should remain accurate and precise. WinRAR, Winzip,7Zip; We realised that most file compression tools like WinRAR, WinZip and 7Zip have the option to encrypt compressed data. So we run these tools with an encryption option and then capture network traffic. The result of this operation is a compressed and encrypted file. We delete the compressed file before executing another tool. 2. Bulk Data Import and Delete. Among the actions that users generally perform on a network share are importing a bunch of data from other storage. This action triggers behaviour closer to ransomware due to the fact that many new files get created, and a lot of data is written at the same time. To mimic this action, we used Windows copy utility as the most used tool in real life. We also used thirdparty tools TeraCopy and UltraCopier because some users prefer them over Windows utilities. We empty the network drive, then paste it in the same folder being used for ransomware analysis and the other way around. 3. Data compression. Sometimes, a user might need to transfer large amounts of files via email, ftp, for sharing with external partners. This can be achieved by compressing multiple files and folders into one. By doing that, a new file First Author et al.: Preprint submitted to Elsevier
Tool Windows Utility
WinRAR WinZip 7-Zip TeraCopy UltraCopier HyCrypt
Action Delete Copy-In Copy-Out Encrypt Zip (.zip) Zip (.rar) Encrypt Zip (.zip) Encrypt Zip (.zip) Zip (.7z) Encrypt Copy Copy Encrypt
Number of RoIs 11 4 8 50 1 11 4 8 652 8 4 1 43 69 1
Table 4 Required SMB Headers Category
Field
Description
Defaults
No
The index number of the packet
Defaults
Time
Time (seconds) elapsed since the capture started
Defaults
Source
Where the packet is coming from
Defaults
Destination
Where the packet is going
Defaults
Protocol
The type of protocol used for this communication
Defaults
Length
The length (in bytes) of the packet
Defaults
Info
The information carried in the packet (payload)
Additional smb2-header-len
SMB header length
Additional smb2-setinfo-size The size of data contained in SMB Set Command Additional smb2-writecount
The size of data contained in SMB Write Command
( container ) is created, and files change extensions pretty much like what ransomware does when it changes the extension of all files after encryption and re-creates file contents. While there are many third-party tools for compressing files, we chose to use WinRAR, WinZip, and 7-Zip because they are the most used tools in the Windows environment. WinRAR and WinZip have output extensions that a user can choose from ( .zip and .rar). We run these tools while capturing network traffic.
4.2. Features Engineering By default, Wireshark displays a limited set of fields for captured network traces, as shown in the Default Group
Page 7 of 12
A Hybrid Framework For Crypto-Ransomware Detection In Enterprise Shared Storage
Tab.4. To enhance the dataset for our experiment, it is necessary to include additional information beyond the default fields. To achieve this, we configure Wireshark to incorporate the extra fields listed in the Additional Group Tab.4. Once the necessary fields are configured, we export the network traces in CSV format. This format is selected for its easy manipulation and efficient handling of the data during the subsequent stages of analysis and processing. Since SMB commands are transmitted over TCP connections, duplicate packets can occasionally appear due to the connection-oriented nature of TCP. To address this, the module is configured to identify and remove duplicates. Some of the additional fields included in the preprocessing are specifically aimed at supporting this task, as the default fields alone may inadvertently lead to the removal of important packets. The final output of this pre-processing module is a clean CSV file, free from duplicates and containing all the necessary information required for further analysis in the subsequent steps.
The procedure outlined in Algorithm 3 requires a set of network packet traces collected from the time the first 𝑝260 appears to the subsequent 𝑝260, excluding the latter. Consequently, we define the Region of Interest (RoI) as the set of activities between two consecutive 𝑝260 packets. The encryption process takes plain text as input into the cypher algorithm in order to produce a ciphertext. That means, the original file contents are replaced with cypher text. Ransomware goes the extra mile by changing the extension of the file. We discovered that the mission is completed using special SMB commands referred to as Commands of Interest (𝐶𝑜𝐼) as explained below.
1. At some point in time, a client wants to read a file that does not exist yet; So it will create it, and the server shall reply confirming that a new file has been created. This response/backward packet has been found with a static length of (410) regardless of the environment or file path. This 𝐶𝑜𝐼is referred to as 𝑟𝑝410. 2. At some point in time, the client will read any file in the current directory; this forward packet has been found with a static length of (171) regardless of envi4.2.1. Region of Interest RoI ronment or file path. This 𝐶𝑜𝐼 is referred to as 𝑟𝑞171 Processing network traffic traces for machine learning 3. At some point in time,, a client will write data to applications presents significant challenges, as individual files in the current directory and the server shall reply network packets typically contain limited information on with the number of bytes written to that file. This their own. Therefore, a critical step in applying machine backward/response packet has been found with a static learning to network traffic is aggregating individual packlength (138) regardless of the environment or file path. ets into more informative data samples. In this research, This 𝐶𝑜𝐼 is referred to as 𝑟𝑝138. we introduce a novel method, referred to as the Region 4. At some point in time, the client will attempt to open of Interest (RoI) technique, to address this issue. The RoI a file/folder, and the server responds with 𝑟𝑝378. method aims to aggregate related packets into cohesive data samples, ensuring that the aggregated information captures 5. At some point in time, the client wants to set new the necessary context for downstream analysis and feature information on files, such as renaming. This forward extraction. Server Message Block (SMB) messages typically packet has been found with a static length of (124) regardless of the environment or file path. This 𝐶𝑜𝐼 Algorithm 3 Extracting 𝑅𝑜𝐼 Techniques is referred to as 𝑟𝑞124. 6. At some point in time, the client will close the open Require: == 𝑁𝑒𝑡𝑤𝑜𝑟𝑘 𝑃 𝑎𝑐𝑘𝑒𝑡𝑠 𝑓 𝑙𝑜𝑤𝑠 file/folder. This forward packet has been found with a 1: Let 𝑡𝑖 , 𝑡𝑗 𝑅𝑒𝑝𝑟𝑒𝑠𝑒𝑛𝑡 𝑡𝑤𝑜 𝑐𝑜𝑛𝑠𝑒𝑐𝑢𝑡𝑖𝑣𝑒 𝑝𝑎𝑐𝑘𝑒𝑡𝑝𝑖 𝑎𝑛𝑑𝑝𝑗 static length of 𝑟𝑞146. 2: Let 𝑝260 𝑅𝑒𝑝𝑟𝑒𝑠𝑒𝑛𝑡 𝑎 𝑝𝑎𝑐𝑘𝑒𝑡 𝑤𝑖𝑡ℎ 𝑙𝑒𝑛𝑔𝑡ℎ == Based on 𝐶𝑜𝐼 as explained above, we compute basic 260 𝑏𝑦𝑡𝑒𝑠 features (𝐵𝐹 ) using algorithm 5. For each 𝑅𝑜𝐼, we count 3: Let 𝑝 ≠ 𝑝260 ∈ , where d is a network the frequency of each 𝐶𝑜𝐼. packet other than 𝑝260 Normally, you can save new data by creating a new file, 4: 𝑅𝑂𝐼𝑖 ← ∀𝑝 ∈ {𝑡𝑖 , 𝑗𝑗 } writing on it, then saving, or by opening an existing file, writing additional data, then saving. The relevant 𝐶𝑜𝐼 as consist of data operation commands for session setup and earlier discussed are 𝑟𝑞171,𝑟𝑝410 and 𝑟𝑝138. 𝑟𝑝138 tells us termination, file opening, reading, writing, status checks, that new data has been successfully saved either following and their respective responses [10]. Our research observed the modification on an existing file 𝑟𝑞171 or by creating a that the SMB client frequently navigates through directonew one 𝑟𝑝410. ries, enumerating contents in a back-and-forth manner. This As depicted in algorithm 4, for each Write response behaviour is facilitated by a specific packet, which remains packet, we find whether it has been triggered by reading consistent in size (260 bytes) regardless of the environment an existing file (𝑟𝑞171) or by creating a new file (𝑟𝑝410). or the directory paths being accessed. It serves as an indicaThe latest trigger to occur before that write response is tor for an SMB client process, signalling it whether all items considered (the closest command to the write response). in the current directory have been enumerated and whether Next, from the extracted 𝐶𝑇 𝑊 and 𝑅𝑇 𝑊 , we compute the client needs to traverse back or forward into other subtotal, mean, and Standard Deviation. The features as results directories. We refer to this packet as 𝑝260 and is extracted of this algorithm are explained in Table 6 using the algorithm in 3. First Author et al.: Preprint submitted to Elsevier
Page 8 of 12
A Hybrid Framework For Crypto-Ransomware Detection In Enterprise Shared Storage
Algorithm 4 Extended Features Computation Techniques
Table 5 Extracted Basic Features Feature
Description
Related 𝐶𝑂𝐼
Source
The origin of a packet (IP address)
n/a
Destination The destination of a packet (IP address)
n/a
Duration
Activity duration
n/a
Read
Number of files read
171
Open
Number of files and directories opened
378
Modify
Number of newly created files
410
Write
Number of files with content modified
138
Set
Number of files with modified attributes
124
Close
Number of files and folders closed
146
Label
Ransomware family or Benign Application Name
n/a
Table 6 Computed (Extended) Features Feature
Description
rtw_cnt
Number of write responses trig- C171 gered by read
Related 𝐶𝑂𝐼
rtw_tot
Total written data triggered by C171 read
rtw_mean
Mean of written data triggered C171 by read
rtw_stdv
Standard deviation of written C171 data triggered by read
rtw_mrw
Most repeating written data C171 triggered by read
ctw_cnt
Number of write responses trig- C410 gered by create
ctw_tot
Total written data triggered by C410 create
ctw_mean Mean of written data triggered C410 by create ctw_stdv
Standard deviation of written C410 data triggered by create
ctw_mrw
Most repeating written data C410 triggered by create
4.2.2. Features Standardization The cumulative values obtained as results of algorithm 4 vary from one production environment to another, as the structure and size of the shared network directory are different and have different infrastructure setups. In order to generalise our method for different environments, we introduced a script to be installed on the file server for constantly reporting statistics of files and directories available in the shared network drive (Probing). We use the probe First Author et al.: Preprint submitted to Elsevier
Require: 𝑅𝑜𝐼 1: Let 𝐶𝑇 𝑊 = ∅; Stands for Create Then Write packets as results of 𝑝410 2: Let 𝑅𝑇 𝑊 == ∅; Stands for Read Then Writes packet as results of 𝑝171 3: Let 𝑐 ∈ 𝑅𝑜𝐼 = {410, 171}; a set of centroids packets 4: Let 𝑟𝑝138(𝑖)𝑖∈ {1, ..., 𝑛}; any Write response packet within 𝑅𝑜𝐼 5: For each 𝑟𝑝138𝑖 ∶ 6: if {(𝑟𝑝138𝑖 − 𝑐0 ) == 𝑀𝑖𝑛𝑖𝑚𝑢𝑚} then 7: 𝐶𝑇 𝑊 ← 𝑟𝑝138𝑖 [𝑤𝑟𝑖𝑡𝑒𝑐𝑜𝑢𝑛𝑡] 8: end if 9: if {(𝑟𝑝138𝑖 − 𝑐𝑖1 ) == 𝑀𝑖𝑛𝑖𝑚𝑢𝑚} then 10: 𝑅𝑇 𝑊 ← 𝐶138𝑖 [𝑤𝑟𝑖𝑡𝑒𝑐𝑜𝑢𝑛𝑡] 11: end if 12: 𝐿𝑒𝑡𝑥 ∈ 𝑅𝑇 𝑊 13: 𝐿𝑒𝑡𝑦 ∈ 𝐶𝑇 𝑊 14: 𝐿𝑒𝑡𝜇, 𝑚𝑒𝑎𝑛 𝑜𝑓 𝑥 𝑜𝑟 𝑦 ∑ 15: X = (𝑥𝑖 ) ∑𝑖 16: 𝑇 𝑜𝑡𝑋 = 0 (𝑥[𝑤𝑟𝑖𝑡𝑒𝑐𝑜𝑢𝑛𝑡]) 𝑇 𝑜𝑡𝑋 17: 𝜇𝑥 = ∑𝑋 18: Y = (𝑦𝑖 ) ∑𝑖 19: 𝑇 𝑜𝑡𝑌 = 0 (𝑦[𝑤𝑟𝑖𝑡𝑒𝑐𝑜𝑢𝑛𝑡]) 𝑇 𝑜𝑡𝑌 20: 𝜇𝑦 = 𝑌√ ∑ { (𝑥𝑖 −𝜇𝑥 )2 𝑋 √ ∑ { (𝑦𝑖 −𝜇𝑦 )2
21: sdvX=
22: sdvY=
𝑌
23: 𝑀𝑅𝑊𝑥 == 𝑥[𝑤𝑟𝑖𝑡𝑒𝑐𝑜𝑢𝑛𝑡]𝑖 ∈ 𝑋, 𝑚𝑜𝑠𝑡𝑓 𝑟𝑒𝑞𝑢𝑒𝑛𝑡 24: 𝑀𝑅𝑊𝑦 == 𝑦[𝑤𝑟𝑖𝑡𝑒𝑐𝑜𝑢𝑛𝑡]𝑖 ∈ 𝑌 , 𝑚𝑜𝑠𝑡𝑓 𝑟𝑒𝑞𝑢𝑒𝑛𝑡
Algorithm 5 Basic Features Computation Procedure Require: 𝑅𝑜𝐼 1: Let 𝑙; 𝑎 𝑎𝑝𝑎𝑐𝑘𝑒𝑡 𝑙𝑒𝑛𝑔𝑡ℎ ℎ𝑒𝑎𝑑𝑒𝑟 𝑠𝑖𝑧𝑒 2: Let 𝑃 ; 𝑃 (𝑙) ∉ {410, 171, 138, 124, 146}; 𝑎 𝑎𝑝𝑎𝑐𝑘𝑒𝑡 3: for each 𝐶𝑜𝐼 ∈ {410, 171, 138, 124, 146} do 4: 𝐵𝐹 = ∀𝑃 , 𝑃 (𝑙) == 𝐶𝑜𝐼 5: end for information; the number of files (𝑛) of the shared drive at the time of capture to convert basic features (𝐵𝐹 ) into rates based on 100 files as per equation 1. The number of features (fields) computed and what each stands for is presented in Table 5. =
∗ 100 𝑛
(1)
4.3. Train Machine Learning Model In this sub-section, we use the dataset that we created as per previous sub-sections to create a learning model that detects the ransomware based on historical sample data. The original dataset from the testbed is imbalanced with 844 benign and 1600 ransomware data samples. Page 9 of 12
A Hybrid Framework For Crypto-Ransomware Detection In Enterprise Shared Storage
• Data Sanitation. We removed data samples corresponding to 𝐼𝑜𝐶. We do this because these data have well-known and distinct characteristics for all ransomware families that cannot be found anywhere with benign samples. These data are collected in a separate repository of 𝐼𝑜𝐶 as previously explained to serve for 𝐼𝑜𝐶 detection phases. This results in reduced ransomware data samples up to 1262. • Data Balancing As it is always a good idea to use a balanced dataset when training an ML model, we used a Python function to select random 844 from 1262 ransomware samples. This task was done while the ransomware samples still had labels (Ransomware Family Name) to make sure that all families are represented. Then we labelled instances of the resulting sub-dataset as ransomware. • Training Vs Testing. Supervised Machine Learning, required labelled sample data for training and unlabeled ones for testing. This can be achieved by splitting the whole dataset into training and testing sub-datasets or by using K-fold cross-validation [4]. Splitting a dataset is most of the time achieved by random sampling. The problem with the method is that a single run may select irrelevant data that influences biased learning. K-fold cross-validation techniques, on the other hand, split the dataset into multiple sample groups (K), resulting in a less biased learning model. So in this research, we used 10-fold cross-validation with different. • Evaluation. We tested the dataset with different traditional Machine Learning techniques and evaluated the performance of each. Unlike in other domains where ML is applicable, high False negative rates expose the business to higher risk than False Positive rates. In other words, a benign application detected as malicious would only cause time waste, leaving company data intact. But a malicious application passed unseen will cause data/system damage, and financial loss and cost more time for recovery [11]. While most of the previous work evaluated ML models based on accuracy and False Positive rates as per equation 2 and 3, respectively, in this research, we extend the evaluation to include false negative rate metrics as per equation 4. 𝐴𝑐𝑐𝑢𝑟𝑎𝑐𝑦 =
(𝑓 𝑝 + 𝑡𝑝) (𝑡𝑛 + 𝑓 𝑝 + 𝑡𝑝 + 𝑓 𝑛)
(2)
𝐹𝑃𝑅 =
(𝑓 𝑝) (𝑓 𝑝 + 𝑡𝑛)
(3)
𝐹 𝑁𝑅 =
(𝑓 𝑛) (𝑓 𝑛 + 𝑡𝑝)
(4)
where; 𝑓 𝑝 == number of Normal classified as Ransomware First Author et al.: Preprint submitted to Elsevier
Table 7 Performance Metrics of Various Classifiers Classification Accuracy FPR RandomCommitee 99.645 0.004 RF 99.585 0.004 Rules.Part 98.874 0.011 lazy.ibk 98.519 0.015 BayesNet 98.045 0.020 Logistics 97.275 0.027
FNR 0.001 0.001 0.010 0.015 0.016 0.022
𝑓 𝑛== number of Ransomware classified as Normal 𝑡𝑝== number of Ransomware classified as ransomware 𝑡𝑛== number of Normal classified as Normal
5. Results and Discussion In this section, we analyse the experimental results and their contribution to advances in ransomware detection. Robustness. We tested the dataset with different machine Learning Models. As the results show in the Table 7, Random Committee classification exhibits the best performance with 99.6% accuracy, 0% False Negative Rate (FNR) and 0. 004% False Positive Rate (FPR). This result represents the best performance achieved in our experiments, demonstrating both robustness and high efficacy. For comparison purposes, we also create models for only 1 (Lockbit2.0) and two (Lockbit2.0 & Maze) ransomware families, as has been done in [1]. In both scenarios, the accuracy achieved is 100 % accuracy. However, we caution that such models are not robust due to the limited scope of ransomware families considered. Given the large and evolving number of ransomware families, we do not recommend this approach for broader applications. Early Detection . Early detection refers to a kind of model in which dynamic features are captured before the executed payload completes all tasks. The objective is to detect intrusion before it causes the most damage [5]. Different scholarly articles, such as [7], proposed methods exclusive to ransomware early detection on a host-based basis. Berrueta et al.[12] proposed a method using a threshold for early detection of ransomware based on SMB network traffic. In our dataset, the smallest ransomware data sample size is 8 for Ako and Coronavirus. So, for each ransomware family, we first created a sliding window of 8 𝑅𝑜𝐼. That means that the first test scenario has 176(8𝑥22), the second has 352(16𝑥22), etc. For each test scenario, we randomly selected an equivalent benign sample from a benign dataset and then classified the data in the same way as for full detection. The window size that produces high accuracy is considered the best for early detection. As shown in Fig. 4a, the first 48 𝑅𝑜𝐼 produced 99.44 % accuracy, just 0.24 % away from full detection accuracy. Since different ransomware families have different numbers of 𝑅𝑜𝐼, it is obvious that the degree to which each of the families can be detected at an early stage is different. For example, Fig. 4b shows that Lockbit can be fully detected with 36 % of its execution. Only Ako, coronavirus, netwalker and Page 10 of 12
A Hybrid Framework For Crypto-Ransomware Detection In Enterprise Shared Storage
(a) Early Detection Accuracy
(b) Early Detectability
Figure 4: Comparison of early detection performance metrics
avoslocker require completion execution as they produced quite a small number of 𝑅𝑜𝐼s. Dataset and 𝐼𝑜𝐶 Repository. As part of the experimentation results, we created a 𝑅𝑜𝐼 dataset from 22 ransomware families and 15 benign applications. Benign and Ransomware samples have all been collected from the same environment (testbed). Benign samples cover an extensive number of benign applications to mimic actions that a human can perform, nearly similar to what ransomware does. We found and extracted a new network-based 𝐼𝑜𝐶 that we stored in a repository for use with signature or rule-based detection techniques.
6. Conclusion & Future Work In this paper, we present a new framework for detecting crypto ransomware through the application of Region of Interest (RoI) techniques to SMB network traffic. The framework operates in three distinct phases: the first two phases function in a signature-based mode, inspecting individual and aggregated packets against known Indicators of Compromise (IoCs), while the third phase employs the Random Committee Learning Model, achieving an impressive accuracy of 99.64%, with no ransomware left undetected. Furthermore, we evaluated the machine learning model for early detection and achieved a notable accuracy of 99.44%. Additionally, our study has led to the discovery of new IoCs, which can be utilised in signature- and rule-based detection systems. This contribution holds substantial significance both academically and industrially. The experiments were conducted on SMB3 for both encrypted and unencrypted network traffic, with the presented IoCs corresponding to unencrypted traffic. However, each code has a counterpart for encrypted traffic. In future work, we aim to expand the analysis to include additional ransomware families and continually update our datasets.
First Author et al.: Preprint submitted to Elsevier
References [1] Almashhadani, A.O., Carlin, D., Kaiiali, M., Sezer, S., 2022. Mfmcns: a multi-feature and multi-classifier network-based system for ransomworm detection. Computers and Security 121. doi:10.1016/ j.cose.2022.102860. [2] Berrueta, E., Morato, D., Magana, E., Izal, M., 2019. A survey on detection techniques for cryptographic ransomware. IEEE Access 7, 144925–144944. doi:10.1109/ACCESS.2019.2945839. [3] Berrueta, E., Morató, D., Magaña, E., Izal, M., 2020. Open repository for the evaluation of ransomware detection tools. IEEE Access 8, 65658–65669. doi:10.1109/ACCESS.2020.2984187. [4] Brownlee, J., 2020. k-fold cross-validation. URL: https:// machinelearningmastery.com/k-fold-cross-validation/. accessed: 9 September 2025. [5] Cen, M., Jiang, F., Qin, X., Jiang, Q., Doss, R., 2024. Ransomware early detection: A survey. doi:10.1016/j.comnet.2023.110138. [6] Corporation, O., n.d. Data encapsulation and the tcp/ip protocol stack (system administration guide, volume 3). URL: https://docs.oracle.com/cd/E19455-01/806-0916/ipov-32/index.html. accessed: 7 February 2025. [7] Deng, X.Z., Cen, M.C., Jiang, M., Lu, M., 2023. Ransomware early detection using deep reinforcement learning on portable executable header. Cluster Computing doi:10.1007/s10586-023-04043-5. [8] EduardoBerrueta, Morato, D., Magaña, E., Izal, M., 2022. Cryptoransomware detection using machine learning models in file-sharing network scenarios with encrypted traffic. Expert Systems with Applications 209. doi:10.1016/j.eswa.2022.118299. [9] Fernando, D.W., Komninos, N., 2024. Fesad ransomware detection framework with machine learning using adaption to concept drift. Computers and Security 137. doi:10.1016/j.cose.2023.103629. [10] Foundation, W., n.d. Smb2/write - wireshark wiki. URL: https: //wiki.wireshark.org/SMB2/Write. accessed: 9 September 2025. [11] Maniriho, P., Mahmood, A.N., Chowdhury, M.J.M., 2022. A study on malicious software behaviour analysis and detection techniques: Taxonomy, current trends and challenges. doi:10.1016/ j.future.2021.11.030. [12] Morato, D., Berrueta, E., Magaña, E., Izal, M., 2018. Ransomware early detection by the analysis of file sharing traffic. Journal of Network and Computer Applications 124, 14–32. doi:10.1016/ j.jnca.2018.09.013. [13] PacketSafari, 2020. Smbv1 vs smbv2 vs smbv3: Understanding the differences and securing your network. URL: https:// www.packetsafari.com/blog/2020/06/09/smbv1-vs-smbv2-vs-smbv3/. accessed: 9 September 2025.
Page 11 of 12
A Hybrid Framework For Crypto-Ransomware Detection In Enterprise Shared Storage [14] University of Queensland, S.o.I.T., Engineering, E., n.d. Machine learning-based nids datasets. URL: https://staff.itee.uq.edu.au/ marius/NIDS_datasets/. accessed: 9 September 2025. [15] Smith, R., 1990. The aids information trojan: An analysis of the pc cyborg virus. Computer Security Journal 6, 58–65.
First Author et al.: Preprint submitted to Elsevier
Page 12 of 12