Mitigating Sodinokibi Ransomware Attack on Cloud Network Using Software-Defined Networking (SDN)

Here is an analysis of previous research on ransomware. Adamov and Carlson conducted mitigation research with spam filters to quarantine suspicious emails, use execution prevention modules, and track Ransomware traffic using the Tor network [12]. Mohammad, in his research, explained two independent classifiers in reducing Crypto-Ransomware attacks, namely: first, user training, security policy, and data backup. Secondly, the detection system uses artificial intelligence [11]. Chakkaravarthy et al. use the Intrusion Detection Honeypot (IDH) and Social Leopard Algorithm systems to detect Ransomware attacks through an early warning on the user's system against suspicious file activity [15]. Xia researched by implementing a Network Assisted Approach (NAA) method to detect ransomware at the local and network level. This system makes it possible to determine which machines the ransomware is on [16]. Agrawal et al., in their research, by adopting deep learning methods to detect Ransomware from emulation sequences, this study used neural networks with extended short-term memory models to record local event patterns in Ransomware [17]. Ganfure et al., researching with the use of the concept of DeepGuard. This concept detects Ransomware based on user behaviour so that DeepGuard can distinguish ransomware activities from user activity with false-positive assessment output [18]. Ayub et al., Perform Ransomware detection on artificial neural networks (ANN) through monitoring of I/O Request Packet (IRP) logs by obtaining the lowest level data [19]. These logs can further describe Ransomware activity [20].

Akbanov et al. conduct mitigation with the WannaCry ransomware virus case using SDN technology. SDN allows being able to detect and reduce the spread of viral infections as the technology changes the flow of the network through OpenFlow, thus breaking the chain of Ransomware attacks [21]. Implementation of SDN in Ransomware mitigation, based on DNS traffic, Pox controller, and WannaCry virus [12, 21]. This mitigation research offers a mitigation approach to the Sodinokibi Ransomware virus using SDN technology, Ryu Controller, and Cloud Network Environment.

2.1 Sodinokibi ransomware

The Sodinokibi virus is known as the REvil virus, which has a type of RaaS attack operation. RaaS means the attack process through cooperation between the ransomware developer and the affiliate spreader. Sodinokibi adopted a high-level encryption technique with two public keys to encrypt the victim's data encryption key, one belonging to develop RaaS and the other belonging to an affiliate. Different from this virus with regular ransomware is using a particular variable, namely Identity Afilisasi embedded. These variables can be configured, run automatically, and send victim data to the C2 server [22, 23].

2.2 System models

This study uses Cloud Network Environment for virtualization to run mitigations and SDN-based network systems as mitigation.

2.2.1 Cloud network environment

Cloud Network Environment is a technology that can share hosts, access distributed environments, and virtualization [24]. The process of creating a virtual environment using VirtualBox and GNS3 software to perform valid and realistic ransomware experiments. In this virtual environment, already available viruses, data, files, infected computers and clean computers [25], making it possible to carry out mitigation to prevent the spread of viruses from cleaning computers. The environmental structure design in this study is as shown in Figure 1.

Figure 1 provides information that the structure of the virtual environment has a computer network with different communication segmentation using black and orange lines. The line's colour difference indicates that the black line is a communication network access point programmed using SDN technology and managed using the Ryu controller. The following is the network configuration data for each device, as shown in Table 1.

Table 1 shows that this environment consists of five devices: two servers with windows and a Ubuntu server; two client computers with Windows 7; and an OpenFlow switch. Each machine uses a configuration with the network address 192.168.10.0/24.

1.png

Figure 1. Environment structure

Table 1. Configuration network

2.2.2 SDN

SDN is a method or paradigm that separates the field of control and the field of forwarding. The control field serves to set up or control network devices, while the forwarding field sends information packets. The advantage of SDN is that it allows the configuration of programmable computer networks. SDN consists of Application, Controller, and OpenFlow switch [26, 27]. The following is an explanation of the image of the SDN structure, as shown in Figure 2.

Figure 2 shows that SDN has a role in managing network traffic based on commands on the application [28]. Generally, the functions of the three SDN layers are the Application layer as a network configuration input such as Rest API commands and python programs. The controller serves as a framework that runs configurations according to application inputs such as Ryu, Pox, Onos and others. The design of the cloud environment network structure, as shown in Figure 3.

The cloud environment network structure built will be checked for feasibility for the mitigation process by testing each device's functionality and connection; This test result serves as the initial setting. On the network structure, note the dotted red line indicating the flow between the host and host to server1 that must be connected, the dotted orange line means communication between the switch and the Ryu controller, the following is the initial contact dataset between devices before the program enters as shown in Table 2.

The entire device cannot connect except server2, which acts as a network controller and has particular communication, run the python program switch_l3.py to upload the communication stream in the dataset so that the network of computers between server1 to the host and host to the host can communicate with each other as in Table 3.

Table 3 shows all devices have successfully communicated after the dataset stream is added via python program from the controller to switch devices. Thus, setting the flow of data packets and network using python programming.

2.png

Figure 2. The SDN structure

3.png

Figure 3. Network structure

Table 2. Connectivity of SDN inactive

Table 3. Connectivity of SDN active

Here is the analysis of the results of there is research mitigation of Sodinokibi virus attack based SDN that allows the prevention of spread or risk on a computer network.

4.1 Potential threats

Mitigation preparation by preparing a testing environment, providing samples of potential threat Sodinokibi Ransomware viruses that serve as objects (https://app.any.run/submissions), and implemented into a phishing website www. skincare shop.42web.io, influences its victims to become infected by downloading and executing malicious files [34]. Here are forensic tools in SDN-based mitigation testing against Sodinokibi Ransomware attacks, as shown in Table 4.

Table 4. Forensic tools

Table 4 describes the type of forensic tools as a support in the mitigation process, namely Wireshark for capture log traffic network, Ryu for network transmission controller, IDS for Ransomware detection, Pestudio for static analysis process, Noriben and Proc. Mon serves for dynamic analysis [35].

4.2 Static analysis

Static analysis results to find out the Indicator of Comprimes (IOCs) as characteristics Sodinokibi virus files and investigate it using Pestudio tools can be seen in Table 5.

Static analysis file in Table 5. provides signature information in the form of md5 hash code, sha1, sha256, first-byte-hex starting with code "4D 5A", first-byte-text beginning with the letter "M Z", file-type "dynamic-link-library", cpu 32bit, and virus signature using Microsoft Visual C++. Based on data files can be retrieved IOCs SHA-256 FBA8297590359DEA 91DB09ACBB4674237D8DBC57EC8B76A3EBE227DA9AE965353.

Table 5. IOCs Sodinokibi

4.3 Dynamic analysis

In the Dynamic analysis process, ransomware must be run in a controlled environment to determine the characteristics of the virus based on Network Behavior and impact, as shown in Figure 5.

5.png

Figure 5. Network traffic log

The results of the network traffic log in Figure 5, showing the spread of Sodin, begins by creating a request session on the NBSS protocol to Roby-PC client computer from an infected computer that is BEGE-PC, then obtained a message "Positive session response", which means that it allows the virus can move from one place to another. The use of the target port is port 139 that is a computer with the host-name Roby-PC. The following details of the use of network protocols by viruses when spreading expansion to other computers as shown in Table 6.

Table 6. Network protocols

Based on the information in Table 6 shows that there are eight network protocols used by the virus when running its attack, namely SMB, SMB2, TCP, UDP, ICMP, NBSS, NBNS, and DNS. In this research, the NBSS protocol has a role in finding the vulnerability and looking for ports that are free to use to open access to other computers, the SMB/SMB2 protocol has a role in opening sessions to connect and open paths between computers, and the TCP protocol has a role to perform data transfer illegally from an infected computer to another. Here the protocol used by the virus during the following deployment process can be seen in Figure 6.

6.png

Figure 6. Network behaviour Sodin/REvil

Figure 6 shows a graph of the spread of Sodinokibi infection to client computers connected to the same network.  Based on the network behaviour graph, most protocols used as infection media are NBSS, SMB, SMB2, and TCP. The following is the suspicious traffic found, as shown in Table 7.

Table 7. Suspicious traffic network

The following is a list of ports used by viruses in infection and spread on computer networks, as shown in Table 8.

Table 8. The ports used Sodinokibi

Table 7 shows the initial infection and spread of viruses in computer networks, and Table 8 shows the list of ports. The process infection starts when the host computer downloads a malicious file on a phishing website with IP Address 185.27.134.218; after the file runs, the file immediately contacts the C2 server with IP Address 35.204.114.36 and spread to other computers with IP Address 192.168.10.5. The following explains the log processes created and virus activity files captured using Noriben tools in Figure 7.

The result log processes created describe the process that Sodin built with PID 1856, accessing %WinDir%\System32 \cmd.exe/c vssadmin.exe for escalation credentials to the administration level, and the File Activity log describes the steps it performs by dropping the payload on %LocalAppData %\ Microsoft \SmartScreen\ARCC970.temp then encrypting the file with sha256 code. Finally, based on dynamic analysis data, the SDN-based mitigation model is designed by preparing a Python script to block the TCP connection of an infected computer, as in Figure 8.

7.png

Figure 7. Logfile

8.png

Figure 8. Python script

In Figure 8, the line "drop flow #TCP" is an essential part of the network control program by SDN Ryu. Here is an explanation of the existing script lines. Python script " match = parser. OFPMatch(eth_type)" serves to verify the ethernet used similarly and focus monitoring on TCP protocol, "mod = parser. OFPFlowMod(data)" helps to add a new entry flow table to OVS, with a priority of 10,000 which means a special command to override the network traffic flow.

4.4 Detection system

The detection system in this study is to check the IP address and port in the process of transmitting data packets based on the IP Address and port access-list storage database used by Sodinokibi Ransomware. The blocklist of IP addresses and ports is as in Table 9, and the implementation of the detection system is as in Figure 9.

Table 9. Blocklist IP address and port

Figure 9 provides illustrative information on how the system detects ransomware network traffic by identifying the IP Address and port that OpenFlow passes through and based on the data in Table 9. If the system detects a virus infection on a particular device, then the system will add a new flow entry to the table "06" on the switch, thereby enabling the blocking of malicious traffic on TCP protocol originating from the infected device.

In general, the flow table consists of three tables, namely the "03" table serves to verify the network similarity, the "06" table helps filter incoming transmission packets and determines which packets can be forwarded or dropped, and the "09" table serves to determine the appropriate output port will send data packets to the destination computer.

9.png

Figure 9. Detection system concept

4.5 Mitigation system

Based on the results obtained at the stage of static and dynamic analysis of the Sodin sample. The mitigation process in this research is to stop the spread of the Sodin/REvil virus through the network by the Ryu Controller software. Ryu Controller controls data flow access on the network, especially the TCP protocol, in real-time. If Ryu Controller gets a command from the detection system to close network access, the mitigation program will start running. This mitigation system starts by running a python script, as shown in Figure 8. The command for Ryu manager "Ryu-manager BlockTCP.py". The results of testing the mitigation system based on Network Behavior are as shown in Table 10, and Figure 10.

Table 10. Network protocols Sodinokibi

Table 10 shows detailed information on the use of network protocols by the virus when the detection system has successfully identified the threat.

Figure 10 shows point "a" log flow switch OpenFlow describes the priority TCP packet dominates in because it is the highest priority with a value of 10.000, so the drop set instruction takes precedence in the entry flow data and applied to the transmission packet. Point "b" showed the log traffic network when the mitigation system dropped the suspicious packet transmission. Point "c" indicates the mitigation process successfully suppressed the speed of virus data flow on TCP protocol so that the packet transmission does not run, the spread and encryption process on another computer has stopped successfully. However, there is an increase of 5639 times in NBSS access protocol as the virus periodically establishes request sessions.

10a.png

(a) Log flow on the switch

10b.png

(b) Log traffic network

10c.png

(c) Graph of protocol traffic on the network

Figure 10. Mitigation results

4.6 Result

The results section of this study provides information on the comparison of packet protocols on computer networks between infection and mitigation processes by blocking TCP packet transmission. The following is a comparison of experimental data based on network protocols, as shown in Table 11.

Based on data in Table 11. It shows that mitigation by blocking the TCP protocol can reduce the infection of Sodinokibi Ransomware 17.13% from a value of 91.1% to 73.97%. The following is a graph of the data from behavioural network-based mitigation experiment results, as shown in Figure 11.

Based on Figure 11. The mitigation data obtained consists of two parts; namely, the first part is the virus infection process, and the second part is the mitigation process by adding flow entries that block TCP protocol access using the python program on the infected device. The mitigation process involves searching for identification of network traffic behaviour throughout the LAN environment and showing suspicious anomalies [36]. Based on Figure 11, mitigation data obtained consists of two parts; that is, the first part of the graph in red is the virus infection process, and the second part of the graph in green is the mitigation process by adding a new stream-entry that blocks TCP protocol access using the python program on the infected device. The mitigation process involves searching for identification of network traffic behaviour throughout the LAN environment and showing suspicious anomalies [36]. This anomaly provides information about the unusual interactions in several protocols such as SMB2, NBSS, and TCP. Viruses generally use access to specific protocols to implement certain conversations and exchange information between two devices.

Table 11. The comparison of network protocols used

11.png

Figure 11. Behavioural network-based mitigation