NEXT-GENERATION RANSOMWARE DEFENSE: DEEP LEARNING-BASED TRAFFIC CLASSIFICATION AT THE NETWORK LAYER

They were more advanced than ever in ransomware, fileless execution, polymorphic encryption, and encrypted C2 communications. The problem, however, widens, with Ransomware as a Service (RaaS) now having joined the party. To fight against these trends, we introduce a next-generation ransomware defense framework that is a deep learning-based real-time detection system capable of detecting ransomware in real encrypted network traffic without any payload inspection. In particular, the system classifies traffic using statistical flow metrics, protocol-specific patterns, and behavioral anomalies by means of transformer-based models. The trained model is tested on a 35 million flow dataset consisting of real ransomware samples, benign enterprise traffic, and adversarial flow samples with around 98.9%, 99.2%, and 98.5% in accuracy, precision, and recall, respectively. In addition, it is robust and scalable for adversarial training and federated learning. The system is deployed into the enterprise environment and has the capability to provide real-time response (0.5s detection) and hence is viable for current enterprise, IoT, and cloud networks