## 8 The Defense Model  
In order to obtain valuable data by using ransomware, the attackers either have to infect one of the clients in the network (e.g., phishing emails, malware infection) and from there, move forward to obtain access to sensitive data, or they need to directly compromise the exposed server (e.g., exploiting the vulnerabilities of the protocols and security flaws of RDP, VPN).  
Remote access to and control over the infected environment occurs via the connection established with the attacker's command and control (C2) infrastructure. This communication process, in the case of infected clients, either starts with a DNS query or with direct IP (hardcoded IP) access, so it is possible to continuously monitor any suspicious DNS queries, direct IP accesses, unusual inbound traffic and large volumes of outbound data movement on the primary DNS server and on the perimeter firewall. During lateral movement in the local network--assuming a centralized data storage architecture, in addition to reconnaissance and compromising further vulnerable devices--the attacker (a bot or human) also scans available network drives. Modification, encryption, deletion and transmission of data to remote locations results in significant data traffic and a large number of file operations (it is loud), which may be clear indicators of an incident (IoC).  
The advanced antivirus solutions available on the market mainly focus on fending off infections and on preventing the execution of malicious code. The aim of the present research was to determine how active malware already infiltrated into the network can be detected on client-independent points (homeypotting, integration checking, log analysis, packet inspection, etc.), while ensuring safe data storage (snapshotting techniques using, i.e., ZFS) and automated backup (e.g., iSCSI, rsync). Advanced malware tend to use a \"living off the land\" (LotL) technique and access data stored on file servers via commonly used protocols.  
By means of monitoring the communication using the man-in-the-middle (MITM) technique between clients and file servers, it is possible to look for anomalies, suspicious patterns of action or data transfer peaks in order to generate alert triggers.  
The schematic model of the proposed method and system can be seen in Figure 11.  
A significant proportion of ransomware running on Windows platforms accesses network drives in alphabetical order. Based on this, honeypot network shares (with drive letters chosen from the beginning or end of the alphabet) can be created, which seemingly contain valid, freshly generated data that fit into the profile of the given organization.  
Figure 11: Network topology of the ARDS model.  
However, their content is fake and their sole purpose is to enable daemons monitoring the drives to log/report any file operation (access, read, write, rename, delete). Obviously, users should be informed in advance that they should not use the \"fake network drives\" in any way. Another opportunity offered by this method is that by limiting the speed of file operations in various ways (e.g., IO limit, old IDE drives, large amounts of small files), the progress of malware can be delayed, thus additional time can by gained for incident response.  
The outlined operating mechanism is directly independent of the user, and it is suitable for the early detection of dangerous processes at many points in the network at service layers. Of course, the diversity of the protection system also includes the preliminary examination and classification of heterogeneous systems. Unlike the systems classifying network infrastructures from the current IT security point of view, the protection system model is based on a weighted assessment in which the vulnerability of the systems is calculated in a system-adaptive way. In the next subsection, the classification, system protection rating, and a model of the complex system providing protection are presented.