Reducing False Negatives in Ransomware Detection: A Critical Evaluation of Machine Learning Algorithms

Abstract

Technological achievement and cybercriminal methodology are two parallel growing paths; protocols such as Tor and i2p (designed to offer confidentiality and anonymity) are being utilised to run ransomware companies operating under a Ransomware as a Service (RaaS) model. RaaS enables criminals with a limited technical ability to launch ransomware attacks. Several recent high-profile cases, such as the Colonial Pipeline attack and JBS Foods, involved forcing companies to pay enormous amounts of ransom money, indicating the difficulty for organisations of recovering from these attacks using traditional means, such as restoring backup systems. Hence, this is the benefit of intelligent early ransomware detection and eradication. This study offers a critical review of the literature on how we can use state-of-the-art machine learning (ML) models to detect ransomware. However, the results uncovered a tendency of previous works to report precision while overlooking the importance of other values in the confusion matrices, such as false negatives. Therefore, we also contribute a critical evaluation of ML models using a dataset of 730 malware and 735 benign samples to evaluate their suitability to mitigate ransomware at different stages of a detection system architecture and what that means in terms of cost. For example, the results have shown that an Artificial Neural Network (ANN) model will be the most suitable as it achieves the highest precision of 98.65%, a Youden’s index of 0.94, and a net benefit of 76.27%, however, the Random Forest model (lower precision of 92.73%) offered the benefit of having the lowest false-negative rate (0.00%). The risk of a false negative in this type of system is comparable to the unpredictable but typically large cost of ransomware infection, in comparison with the more predictable cost of the resources needed to filter false positives.

Opinion mining toward work from office policies on post-pandemic covid-19 by using supervised learning

“…Furthermore, an analysis was carried out with the RapidMiner Studio application in making an appropriate and automatic classification program. The confusion matrix, a technique for gauging the algorithm model's level of accuracy throughout the classification phase, is used for the model's evaluation and validation at this point [20], and a table that can show how well the categorization model performs [21]. The classification of prediction data derived from models based on real or accurate data is shown in Table 1.…”

“…The method starts with entering data that was gathered during the data collecting stage, and it then moves on to text mining utilizing the naive Bayes algorithm model, support vector machine, knearest neighbors, and random forest from the outcomes of preprocessing. The performance results of the algorithm model then show that a text classification is formed into many categories.d) Validation evaluationThe confusion matrix, a technique for gauging the algorithm model's level of accuracy throughout the classification phase, is used for the model's evaluation and validation at this point[20], and a table that can show how well the categorization model performs[21].…”

Enhancing Ransomware Detection: A Windows API Min Max Relevance Refinement Approach

“…As the digital sphere continues to evolve, the methods employed ✹✸ by ransomware have become increasingly sophisticated, leveraging various attack vectors ✹✹ to infiltrate and compromise systems [1,14]. This relentless progression of ransomware ✹✺ attacks requires a continuous and rigorous approach to cybersecurity, particularly in the ✹✻ development of dynamic and resilient strategies to counteract these threats [1, 15,16].…”

“…The dense and disordered nature of these ✻✵ traces often leads to a surge in computational overhead and a consequent depletion in the ✻✶ ability to accurately pinpoint and characterize malevolent activities [14,22]. This increase ✻✷ in resource consumption coupled with the challenge of accurately discerning the malicious ✻✸ from the benign has driven researchers and cybersecurity professionals to seek out more ✻✹ advanced and nuanced methods of detection and analysis [15,23,24]. As ransomware ✻✺ evolves, so too must the tools and techniques employed to detect it, underscoring the need ✻✻ for continuous innovation in the realm of cybersecurity [25,26].…”

Novel Ransomware Detection Exploiting Uncertainty and Calibration Quality Measures Using Deep Learning

“…Additionally, [11] suggests monitoring external server connections to identify ransomware activities early on, thereby preventing the completion of the encryption processes. Bold et al [12] stress the importance of intelligent early detection in reducing false negatives, emphasizing the advantages of promptly identifying and eradicating ransomware. Thus, early detection of ransomware through advanced detection techniques is essential to prevent data loss, financial harm, and operational disruptions resulting from ransomware attacks.…”