Leveraging Machine Learning for Ransomware Detection

Abstract

The current pandemic situation has increased cyber-attacks drastically worldwide. The attackers are using malware like trojans, spyware, rootkits, worms, ransomware heavily. Ransomware is the most notorious malware, yet we didn't have any defensive mechanism to prevent or detect a zero-day attack. Most defensive products in the industry rely on either signature-based mechanisms or traffic-based anomalies detection. Therefore, researchers are adopting machine learning and deep learning to develop a behaviour-based mechanism for detecting malware. Though we have some hybrid mechanisms that perform static and dynamic analysis of executable for detection, we haven't any full proof detection proof of concept, which can be used to develop a full proof product specific to ransomware. In this work, we have developed a proof of concept for ransomware detection using machine learning models. We have done detailed analysis and compared efficiency between several machine learning models like decision tree, random forest, KNN, SVM, XGBoost and Logistic Regression. We obtained 98.21% accuracy and evaluated various metrics like precision, recall, TP, TN, FP, and FN.

Efficient Ransomware Detection via Portable Executable File Image Analysis By LLaMA-7b

“…Finally, the contribution of big data analytics in the arena of ransomware detection has gained attention [17,30]. This approach underscores the role that large-scale data sets play in forecasting and pre-empting potential ransomware attacks, thereby fortifying defenses against such cyber threats [31,32].…”

Trends and Future Directions in Automated Ransomware Detection

“…Recent studies also have limitations and gaps which may be explored by future research. Future research based on the work of Rani and Dhavale (2022) should consider the integration of the model with Elasticsearch Logstash Kibana (ELK) to develop a practical tool for real-life ransomware detection. ELK can serve as the backend for filtering and collecting useful log data for the ransomware detection system.…”