Automated Analysis Approach for the Detection of High Survivable Ransomware

Abstract

Ransomware is malicious software that encrypts the user-related files and data and holds them to ransom. Such attacks have become one of the serious threats to cyberspace. The avoidance techniques that ransomware employs such as obfuscation and/or packing makes it difficult to analyze such programs statically. Although many ransomware detection studies have been conducted, they are limited to a small portion of the attack's characteristics. To this end, this paper proposed a framework for the behavioral-based dynamic analysis of high survivable ransomware (HSR) with integrated valuable feature sets. Term Frequency-Inverse document frequency (TF-IDF) was employed to select the most useful features from the analyzed samples. Support Vector Machine (SVM) and Artificial Neural Network (ANN) were utilized to develop and implement a machine learning-based detection model able to recognize certain behavioral traits of high survivable ransomware attacks. Experimental evaluation indicates that the proposed framework achieved an area under the ROC curve of 0.987 and a few false positive rates 0.007. The experimental results indicate that the proposed framework can detect high survivable ransomware in the early stage accurately.

An Attribute Extraction for Automated Malware Attack Classification and Detection Using Soft Computing Techniques

“…A decision tree is a straightforward structure derived from nonnodes that indicate tests across one or more characteristics and network interface layer that provide decision results. At each node of the logistic regression, the information gain measure is utilized to choose the test attribute [ 28 ]. They obtained the following metric favors characteristics with a high number of possible values.…”

Machine Learning Algorithms and Frameworks in Ransomware Detection

“…The features were divided into seven subset features (top20, top30, top40, top50, top60, top70, top80) by considering their importance and ranking based on phase 2 processing. The results of the experiment demonstrated that ANN showed the highest accuracy of 98.79% when the top30 of the feature set was used as training and testing [27]. However, this classification accuracy had dramatically decreased to 95.63% when the top20 of the feature set was used.…”

“…These frameworks yield promising results in detection of different types of ransomware and have potentials to be used in future research works by the cyber security community. In what follows, eight state-of-the-art frameworks including Behavior Based [27], DNAact-Ran [28], RANDS [30], RATAFIA [32], RansomWall [33], CryptoKnight [34], EldeRan [35], and DRTHIS [40] will be studied and compared.…”

“…A proposed behavior-based framework was built for defining dynamically monitored valuable features of high survivable ransomware (HSR) [27]. The analysis of HSR was conducted within an isolated sandbox environment, through the Term Frequency-Inverse document frequency (TF-IDF).…”

“…The 10-Fold crossvalidation technique can prevent the overfitting problem and estimate the effectiveness of the detection models. The best accuracy obtained by SVM is by presenting 0.982 of area under the curve (AUC) with less than 0.035 of false positive rate [27]. It is important to examine the ability of the classifiers for distinguishing the ransomware from benign samples.…”