journal: Digital Forensics and Cyber Crime (ICDF2C 2026)
Book Series: Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering (LNICST), Volume 720, Pages 298每317
Authors: Mohammed A. Makarem, Akram Algaolahi, Ashraf Mahmoud, Mohammad Zulkernine
Published date: 2026-09-08
DOI: 10.1007/978-3-032-37274-1_18
PDF link: https://link.springer.com/chapter/10.1007/978-3-032-37274-1_18
Article link: https://doi.org/10.1007/978-3-032-37274-1_18
Article Source: Springer Nature
Remark:
This paper presents a forensic framework for detecting ransomware-related evidence through burst-based network traffic analysis. It focuses on identifying short, intense bursts of outbound network traffic directed towards suspicious IP addresses, which can serve as indicators of ransomware activity.
The proposed framework combines packet-level feature extraction, network burst detection, destination-based filtering, and machine-learning-based classification to generate forensic alerts containing useful information such as destination IP addresses, communication timestamps, and session frequencies.
The framework was evaluated using the CICAndMal2017 dataset, where the Random Forest classifier achieved the best performance, with 92.69% accuracy, 94.33% recall, an F1-score of 92.81%, and an AUC of 98.41%. The authors also validated the framework using controlled executions of real ransomware samples across multiple ransomware families.
The findings demonstrate how network communication patterns can provide valuable forensic evidence for ransomware detection, incident investigation, and timeline reconstruction, complementing traditional host-based forensic approaches.
|
250