Ransomware Command and Control Detection using Machine Learning

Since the first attack in 1989, ransomware attacks have gained popularity, and defending against it is now part of what AI-powered cyber security, built on machine learning, is expected to do. It has created havoc across every possible industry, including government offices, public-sector departments, and hospitals. Apart from the financial strain that ransomware can bring, it also affects everyday aspects of public life. For instance, the WannaCry attack on hospitals, police stations, and government offices has hindered daily life for regular citizens across numerous countries. To make things worse, ransomware is now available as a service on the darknet, so any novice attacker can avail the ransomware service to start an attack of their own. This leads to a situation in which the same entity is attacked more than once.

At a glance

• Command-and-control servers need DNS queries to reach them, and ransomware is no exception.
• Those queries carry a measurable statistical fingerprint in the domain name.
• A classifier trained on domain features such as bigrams and entropy spots that fingerprint without recognizing the malware.
• Deception decides when to run the classifier, on a narrow window, not every query.
• Acalvio is a Leader and Outperformer in the GigaOm Radar for Deception Technology, four consecutive years, most recently 2026.

Like other malware, ransomware also has a kill chain. That typically includes luring the victim via phishing or other means, loading the payload, i.e., installing the ransomware on the target host, and finally spreading and detonating the ransomware, i.e., encrypting the host’s memory and demanding the ransom via a ransomware note. The ransomware attack starts when a user clicks a malicious web link or opens the attached file in a phishing email. Now, ransomware is installed on the target machine. Depending on the strain, the detonation can happen before it spreads. To encrypt the machine’s data, ransomware needs to use an encryption key. It may or may not use the Command and Control (C&C) to get the encryption keys. The ransomware without C&C uses hardcoded encryption keys or locally generated keys and uses the same keys for all the infected hosts. In this case, security experts can reverse engineer the malware binaries and may find the keys. However, the ransomware using the C&C gets the encryption keys from the C&C server hosted by the attacker. WannaCry, LockBit, Akira, Qilin, and Cl0p are some of the ransomware families using C&C, which means recovering the encryption keys without the attacker’s cooperation requires finding a flaw in how they were generated or stored.

Figure 1: Ransomware attack using command & control (C&C) for encryption key management

Ransomware uses different asymmetric and symmetric encryption techniques, e.g., RSA, AES, for generating encryption keys. Attackers are becoming more sophisticated and using both techniques in combination. An AES key is hardcoded within the payload to encrypt the files on the infected machine, and then an RSA public-private key pair is generated and used to encrypt the AES encryption key, with the private RSA key uploaded onto the C&C server.

In early variants of ransomware, the C&C server addresses were hardcoded in the malware binaries. Hardcoded addresses stay the same across infections, so once defenders found one, they could block it. Ransomware then started using Domain Generation Algorithm (DGA)-based techniques to connect to C&C servers. With the DGA, attackers generate dynamic domain names and redirect their C&C servers to these dynamic addresses. Firewalls, IDS/IPS, and threat intelligence feeds all depend on a domain being known somewhere first, and a freshly generated DGA domain has, by design, nothing on record yet.

The main use of the C&C is to contact the C&C server using a domain name; if the domain can be detected and blocked immediately, the attack can be stopped from spreading to other machines. For example, thisisyourchangeqq.com and gvludcvhcrjwmgq.in are two C&C domains used by TeslaCrypt and Locky ransomware respectively.

Ransomware connects to the C&C server using DNS queries. To establish the connection, DNS resolution queries are made for domains generated by the ransomware. These queries are captured in the DNS logs of the system. By analyzing DNS logs, we can detect domains used for the C&C. In machine learning (ML), this problem can be posed as a classification problem where there are two classes, i.e., benign DNS server and malicious C&C domain server. Several machine learning classifiers, such as Random Forest, Support Vector Machine (SVM), and Artificial Neural Networks, can be used as classifiers. Using discriminatory and informative features from the DNS logs, one can build a classification model to detect the C&C domains.

We trained an ML classifier using a Random Forest classifier to detect domains generated by DGAs. Features such as bigram and trigram scores are informative and discriminating for classifying C&C domains from benign domains. A bigram score tells how often that bigram is likely to occur in a normal English word. This score is lower in a DGA-generated domain. We computed trigram_benign and trigram_malicious scores that are fractions of trigrams present in the benign and malicious corpus respectively. The entropy of a domain is also different for both malicious and benign classes of domains. We used Shannon entropy as another feature to differentiate between benign and malicious domains.

Example domain: google.co.in bigrams: [‘$g’, ‘go’, ‘oo’, ‘og’, ‘gl’, ‘le’, ‘e$’, ‘$c’, ‘co’, ‘o$’, ‘$i’, ‘in’, ‘n$’] trigrams: [‘$go’, ‘goo’, ‘oog’, ‘ogl’, ‘gle’, ‘le$’, ‘$co’, ‘co$’, ‘$in’, ‘in$’]

Figure 2: An example of how bigrams and trigrams are extracted from a domain

Figure 3: Frequency distribution plots of entropy, bigrams and trigram features

Example: Benign domains

Example: Malicious domains

Figure 4: Precision-Recall curve for the classifier

Figure 5: Code snippet of C&C Detection Classifier

Figure 6: Test run on some normal domains and some C&C

In the above example, “google.com” and “howstuffworks.com” are benign domains, and the other domains are used by Locky ransomware for the C&C. The domain “fofsslkwvwee.de” got the maximum malicious score (=1.0); however, the other three malicious domains that look like normal domains got a score less than one.

Typically, ML-based C&C detection is deployed at the perimeter to monitor every DNS domain, which needs big data infrastructure to process a high volume of DNS logs. Our approach to C&C detection is event-driven: the classifier runs on a narrow window of DNS traffic right after a deception event, rather than continuously, which is what the boiling-the-ocean approach requires. In our approach, we use deception to detect the ransomware and then apply machine learning to detect the C&C. In this approach, one does not need to monitor all the DNS traffic all the time. Once detected, these domains can be blocked to stop the ransomware from spreading further in the organization. We analyze the domains only when we detect ransomware attack from our deception-based solution, the ShadowPlex Preemptive Cybersecurity Platform, hence the false positive detection rate is very low.

Figure 7: Low False-Positive rate against various ransomware families

We tested our approach on nearly 20 different ransomware families, and results are summarized in Figure 7. “Detected C&C domains” is the number of domains detected by our solution, and “Actual C&C domains” was the actual number of C&C domains used by the ransomware. Our solution can achieve a nearly 100% true detection rate on DGA-based C&C domains in this study, with a false positive rate of nearly 2.5%. We have not re-validated this result against ransomware families that do not rely on DGA-based C&C the same way, so these figures describe this study’s scope. The results demonstrate the power of combining deception along with machine learning for C&C detection.

The classifier described above, a supervised model trained on engineered domain features such as bigram, trigram, and entropy scores, is the same class of technique now marketed broadly as AI-powered cyber security and AI-driven cyber security.

This page is an example of that technique applied to one problem, not a precursor to it. Attackers now use AI themselves to generate more convincing domains faster than a static, once-trained model can track, which is why a classifier needs deception around it deciding when to run it and when to retrain it. ShadowPlex is where that ongoing work now lives, auto-designing deception and adapting it as attacker behavior and infrastructure change, with this classifier as one detection layer inside it.

Autonomous threat detection across multi-cloud environments means the deception layer raises an event, a classifier scores it, and a block follows without an analyst in the loop.

Monitoring every DNS query at a perimeter assumes one perimeter; an estate spread across AWS, Azure, and GCP has several, so continuous inspection scales with the number of environments, not with actual incidents. An event-driven trigger does not: the deception layer only raises a signal when something touches an asset with no legitimate use, so the classifier runs on a narrow window across all of them. ShadowPlex Cloud Security applies this model natively across AWS, Azure, and GCP without agents.