Ransomware Detection with CNN and Deep Learning Based on Multiple Features of Portable Executable Files

Abstract

Due to the epidemic, many industries need to rely on computers to perform necessary tasks. In case of a ransomware attack, the consequences are unimaginable. In order to avoid ransomware attacks, many researchers have proposed large number of methods to distinguish between benign programs and ransomware, but ransomware keeps changing, making these methods gradually ineffective and leaving the virus attacks unresolved. This study collected 1200 samples of ransomware with 80 families, includes packed, encrypted, and variants, so that the models could protect against variants of ransomware. Based on the DLL, Subsystem, Subsystem Version, N-gram as features, we made three deep learning models that could support variable shape size. After experiments, the best model Accuracy was 99.77%, Recall was 99.72%, and Precision was 99.81% We also designed a program that could load the completed models, and provide users with the ability to scan their own computers so that they could be protected from ransomware. 2010 MSC: 00-01, 99-00