Inline ransomware detection via server message block (SMB) traffic
Inline detection of ransomware attacks using network traffic, such as server message block (SMB) traffic, is disclosed. A network communication between a client and a server is received. A determination is made, using the received network traffic, that a ransomware attack is being attempted against the server. In response to detecting the attempted ransomware attack, a remedial action is performed.
1. A system, comprising:
a processor configured to:
receive, at a firewall appliance interposed between a client and a server, a server message block (SMB) network communication between the client and the server as part of a session between the client and the server;
determine, at the firewall appliance, and using the received SMB network communication, an attempted creation of a ransom note associated with an attempted ransomware attack on the server by the client, wherein the determining includes detecting at least one of a file creation or file open request made by the client to the server and applying at least one of a trained model or a set of rules to identify the attempted creation on the server by the client of the ransom note; and
in response to detecting the attempted ransomware attack, perform a remedial action, including by terminating, by the firewall appliance, the session between the client and the server; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1 , wherein the processor is further configured to detect a file encryption of a file on the server and initiated by the client.
3. The system of claim 1 , wherein the model was trained on ransomware notes.
4. The system of claim 1 , wherein the applying includes using a set of heuristics.
5. The system of claim 2 , wherein detecting the file encryption includes detecting a file entropy change.
6. The system of claim 2 , wherein the file encryption is a partial encryption.
7. The system of claim 1 , wherein the applying includes forwarding, by the firewall appliance, at least a portion of the network communication to a remote device.
8. The system of claim 1 , wherein performing the remedial action includes generating an alert.
9. A method, comprising:
receiving, at a firewall appliance interposed between a client and a server, a server message block (SMB) network communication between the client and the server as part of a session between the client and the server;
determining, at the firewall appliance, and using the received SMB network communication, an attempted creation of a ransom note associated with an attempted ransomware attack on the server by the client, wherein the determining includes detecting at least one of a file creation or file open request made by the client to the server and applying at least one of a trained model or a set of rules to identify the attempted creation on the server by the client of the ransom note; and
in response to detecting the attempted ransomware attack, performing a remedial action, including by terminating, by the firewall appliance, the session between the client and the server.
10. The method of claim 9 , further comprising detecting a file encryption of a file on the server and initiated by the client.
11. The method of claim 10 , wherein detecting the file encryption includes detecting a file entropy change.
12. The method of claim 10 , wherein the file encryption is a partial encryption.
13. The method of claim 10 , wherein the model was trained on ransomware notes.
14. The method of claim 9 , wherein the applying includes using a set of heuristics.
15. The method of claim 9 , wherein the applying includes forwarding, by the firewall appliance, at least a portion of the network communication to a remote device.
16. The method of claim 9 , wherein performing the remedial action includes generating an alert.
17. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
receiving, at a firewall appliance interposed between a client and a server, a server message block (SMB) network communication between the client and the server as part of a session between the client and the server;
determining, at the firewall appliance, and using the received SMB network communication, an attempted creation of a ransom note associated with an attempted ransomware attack on the server by the client, wherein the determining includes detecting at least one of a file creation or file open request made by the client to the server and applying at least one of a trained model or a set of rules to identify the attempted creation on the server by the client of the ransom note; and
in response to detecting the attempted ransomware attack, performing a remedial action, including by terminating, by the firewall appliance, the session between the client and the server.