Mitigating Self-Propagating Ransomware using Software Defined Networking
Self-propagating ransomware remains a major threat to network security because of its ability to spread rapidly across vulnerable hosts, encrypt critical files, and disrupt organizational operations. Existing host-based solutions often require installation on individual devices, while many network-based and SDN-based approaches mainly focus on detecting suspicious traffic or isolating entire infected hosts, which may disrupt legitimate services. This study developed an enhanced Software-Defined Networking-based mitigation technique for detecting and containing self-propagating ransomware through behavioral analysis and selective service-level isolation. The proposed technique monitors abnormal traffic patterns associated with ransomware propagation and uses a POX-based SDN controller to dynamically install OpenFlow rules that block infected services while allowing unaffected services on the same host to remain operational. The technique was evaluated in a virtualized SDN testbed using BadRabbit, WannaCry, and GandCrab ransomware samples under different threshold values. Performance was assessed using accuracy, precision, recall, F1-score, detection time, and containment time. The results showed that the proposed technique achieved detection accuracy of 95% for BadRabbit and 93% for both WannaCry and GandCrab. It also achieved strong F1-scores across the evaluated ransomware variants and reduced average containment time to 7 seconds compared with 30 seconds reported in the benchmark SDN-based method. These findings demonstrate that selective service-level isolation can provide faster ransomware containment while preserving network availability. The study contributes a practical SDN-based mitigation approach for real-time containment of self-propagating ransomware in networked environments.
Download Paper