Ransomware detection using machine learning algorithms

Abstract

Summary The number of ransomware variants has increased rapidly every year, and ransomware needs to be distinguished from the other types of malware to protect users' machines from ransomware‐based attacks. Ransomware is similar to other types of malware in some aspects, but other characteristics are clearly different. For example, ransomware generally conducts a large number of file‐related operations in a short period of time to lock or to encrypt files of a victim's machine. The signature‐based malware detection methods, which have difficulties to detect zero‐day ransomware, are not suitable to protect users' files against the attacks caused by risky unknown ransomware. Therefore, a new protection mechanism specialized for ransomware is needed, and the mechanism should focus on ransomware‐specific operations to distinguish ransomware from other types of malware as well as benign files. This paper proposes a ransomware detection method that can distinguish between ransomware and benign files as well as between ransomware and malware. The experimental results show that our proposed method can detect ransomware among malware and benign files.

Avoiding Future Digital Extortion Through Robust Protection Against Ransomware Threats Using Deep Learning Based Adaptive Approaches

“…The experimental evaluation of this work claims that the ransomware activities can be identified through a unique low-level system calls that are present in the ransomware. Lorenzo Fernández et al [16], Suhyeon Lee [13], and Seong Il Bae et al [27] use dynamic analysis and supervised machine learning technique. The proposed approaches mostly focused on static, dynamic, or file monitoring approaches and face challenges to detect new variants of ransomware due to their supervised nature in detection engine.…”

A Study on the Evolution of Ransomware Detection Using Machine Learning and Deep Learning Techniques

“…These n-gram sequences are used to identify ransomware and differentiate them from other malware and benign software. Each element of the input can be represented as "1" if an n-gram appears in the n-gram sequence or as "0" if the n-gram is not present in the sequence [23].…”

“…This technique is used to emphasise the features of each class, therefore giving further ability to differentiate between malware, ransomware and benign files. CF-NCF calculates weights on an element in a class, to provide a higher accuracy on classification experiments [23]. The calculation of this equation can be seen in Equations (16)- (18).…”

“…(17) In these equations, s is an n-gram, and f (s, C) is the number of times that the n-gram s occurs in the n-gram sequence C of a particular class. N is the n-gram sequences of the other classes, and 0.001 serves to prevent the denominator from becoming zero [23].…”

“…blj is the Bernoulli random vector, where P(blj = 1) = pl, j, the dropped neuron, will depend on the Bernoulli random vector. The use of root mean square propagation (RMSprop) is used to adjust the learning rate, so the step size stays on the same scale as the gradient where λ is the forgotten coefficient, Q(w) 2 is the gradient at w. The use of the root square propagation is similar to the use of weight decay; it keeps the moving average of the gradient; this is presented in Equations (22) and (23).…”