Machine Learning Algorithms and Frameworks in Ransomware Detection

Abstract

Ransomware has been one of the biggest cyber threats against consumers in recent years. It can leverage various attack vectors while it also evolves in terms of finding more innovative ways to invade different cyber security systems. There have been many efforts to detect ransomware within the workforce and academia leveraging machine learning algorithms, which has shown promising results. Accordingly, there is a considerably large body of literature addressing various solutions on how ransomware threats can be detected and mitigated. Such large and rapidly growing scientific and technical materials start to make it difficult in knowing the actual ML algorithm(s) being used. Hence, the aim of this paper is to give insight about ransomware detection frameworks and those ML algorithms which are typically being used to extract ever-evolving characteristics of ransomware. In addition, this study will provide the cyber security community with a detailed analysis of those frameworks. This will be augmented with information such as datasets being used along with the challenges that each framework may be faced with in detecting a wide variety of ransomware accurately. To summarize, this paper delivers a comparative study which can be used by peers as a reference for future work in ransomware detection.

A Survey on Ransomware Threats: Contrasting Static and Dynamic Analysis Methods

“…initiates the encryption of user data using the AES algorithm without requiring connection to a command and control center (C&C) [8]. Locky ransomware, first seen since 2016, propagated through embedded macros within Microsoft Office documents and facilitated encrypted communications for Tor and Bitcoin transactions [29]. The infamous WannaCry attack in 2017, which leveraged the Microsoft Windows EternalBlue security vulnerability to target the Server Message Block protocols, affected over 300,000 computers across more than 100 countries and encrypted files using the AES algorithm [30].…”

“…Techniques such as entropy measurement for detection can be circumvented when ransomware employs complex encoding strategies [54]. Moreover, machine learning models that depend on static attributes might not exhibit the flexibility to generalize across the spectrum of ransomware families, resulting in potential shortcomings [29]. Consequently, metadata analysis often concentrates on recognized ransomware families, encountering challenges in detecting novel or zero-day threats with advanced obfuscation techniques [39].…”

Enhanced Ransomware Identification via Feature Extraction with Class Feature Weighting

“…Such methodologies not only act as an early warning system but also as a means to study the attack patterns of ransomware without the risk of actual data loss or system damage. On the other hand, behavior-based techniques involve a granular observation of system operations, cataloging file access patterns, and modifications to detect deviations from established norms [10,[23][24][25][26].…”

“…The integration of artificial intelligence into ransomware detection represents a significant shift from these traditional methods, capitalizing on the capacity of machine learning algorithms to discern patterns in large datasets and deep learning's ability to learn from data in a more human-like manner [27][28][29]. Machine learning, particularly, has been instrumental in enhancing the predictive accuracy of detection systems [26,[30][31][32][33]. By analyzing the metadata and invocation sequences of APIs, support vector machines, and other learning models have been utilized to classify software behavior effectively, distinguishing between benign and ransomware-infected states [9,11,12,14,34].…”

Ransomware Detection Using Machine Learning: A Review, Research Limitations and Future Directions

“…Several surveys have reviewed the ransomware detection domain over this period as shown in Table . 3. These surveys broadly focus on: (1) the features or input data used to train machine learning algorithms [11]- [32]; (2) ransomware behaviour and trends [13], [14], [16]- [22], [25], [27], [28], [31], [32]; (3) detection techniques [11]- [14], [16]- [27], [29]- [32]; (4) the algorithms used to detect ransomware [11]- [13], [15], [16], [18], [19], [25]- [32]; (5) ransomware prevention strategies [20]. However, despite recent research efforts, several key limitations emerge from existing surveys:…”