Machine Learning-Based Ransomware Classification of Bitcoin Transactions

Alsaif, Suleiman Ali

doi:10.1155/2023/6274260

Cited by 10 publications

(20 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The F1 score, a harmonic mean of precision and recall [13], [62], offers a balanced assessment of an algorithm's effectiveness by considering false positives and false negatives. It proves particularly beneficial for imbalanced datasets [63], with a higher F1 score denoting a better balance between precision and recall.…”

Section: B Evaluationmentioning

confidence: 99%

“…This proactive strategy holds profound significance and implications in the classification and detection of ransomware transactions. BTC transactions, given their decentralized and pseudonymous nature, offer a unique digital footprint that encapsulates the essence of ransomware activities within the crypto ecosystem [63]. The significance lies in the fact that ransomware attackers typically demand payments in cryptocurrencies like BTC due to their anonymity, which makes BTC transactions an invaluable source of insight into potential ransomware-related activities [63].…”

Section: A Limitations and Future Research Directionsmentioning

confidence: 99%

“…BTC transactions, given their decentralized and pseudonymous nature, offer a unique digital footprint that encapsulates the essence of ransomware activities within the crypto ecosystem [63]. The significance lies in the fact that ransomware attackers typically demand payments in cryptocurrencies like BTC due to their anonymity, which makes BTC transactions an invaluable source of insight into potential ransomware-related activities [63]. By meticulously monitoring BTC transaction patterns, cybersecurity experts and systems can discern anomalous behavior that aligns with characteristics often associated with ransomware incidents.…”

Section: A Limitations and Future Research Directionsmentioning

confidence: 99%

“…Moreover, BTC transaction monitoring can aid in the early detection of potential ransomware activities by leveraging ML algorithms and anomaly detection techniques. These methods scrutinize historical transaction data to identify deviations from regular transactional behavior to enable the proactive flagging of suspicious activities indicative of ransomware activities [14], [63]. The practicality of monitoring BTC transactions lies in its real-time nature and provides an opportunity for swift action and mitigation measures in response to identified anomalies [60].…”

Section: A Limitations and Future Research Directionsmentioning

confidence: 99%

See 3 more Smart Citations

RFSA: A Ransomware Feature Selection Algorithm for Multivariate Analysis of Malware Behavior in Cryptocurrency

Nkongolo Wa Nkongolo

2024

IJCDS

View full text Add to dashboard Cite

This research introduces innovative features tailored to capture distinctive characteristics of ransomware activity within the cryptocurrency ecosystem. The study employs a multifaceted analysis to delve into ransomware-related data encompassing transaction metadata, ransom analysis, behavioral patterns, and financial aspects. A feature selection algorithm is explored to discern ransomware transactions in Bitcoin (BTC) and the United States Dollar (USD) using the UGRansome dataset. This comprehensive dataset of ransomware-related transactions facilitates the proposal of novel features designed to capture the unique traits of ransomware activity. The correlation matrix and temporal analysis of these features contribute to a nuanced understanding of the dynamic nature of ransomware threats. The research presents the Ransomware Feature Selection Algorithm (RFSA) based on Gini Impurity and Mutual Information (MI) to effectively select crucial ransomware features. Evaluation metrics such as precision, recall, accuracy, and F1 score highlight the effectiveness of the RFSA. The analysis reveals that approximately 68% of ransomware incidents involve BTC transactions ranging from 1.46 to 2.56, with an average of 2.01 BTC transactions per attack. Moreover, ransomware causes financial damages ranging from 4.38 to 172.36 USD, with an average damage of 88.37 USD. The RFSA identifies 17 ransomware types and their associated malware to shed light on their characteristics. The study investigates the pricing of ransomware and reveals that TowerWeb is associated with the highest fee, amounting to 135.26 BTC, while CryptoLocker has the lowest fee, recorded at 10.51 BTC. Additionally, the impact of ransomware duration on financial gains and network flow is investigated, disclosing a correlation between extended duration and higher financial gains. The research achieves outstanding performance metrics, including an MI score of 95%, accuracy of 93%, recall of 92%, and precision of 89%. These results showcase the superiority of the proposed approach over existing studies, emphasizing the dynamic and adaptable nature of ransomware demands. The findings suggest that there is no fixed amount for specific cyberattacks. This underscores the importance of adapting to the evolving landscape of ransomware threats.

show abstract

Section: B Evaluationmentioning

confidence: 99%

Section: A Limitations and Future Research Directionsmentioning

confidence: 99%

Section: A Limitations and Future Research Directionsmentioning

confidence: 99%

Section: A Limitations and Future Research Directionsmentioning

confidence: 99%

See 2 more Smart Citations

RFSA: A Ransomware Feature Selection Algorithm for Multivariate Analysis of Malware Behavior in Cryptocurrency

Nkongolo Wa Nkongolo

2024

IJCDS

View full text Add to dashboard Cite

show abstract

“…Gradient boosting is a machine learning technique used for regression and classification tasks [37]. It works by combining multiple weak learners, typically decision trees, into a single strong learner.…”

Section: Extreme Gradient Boostingmentioning

confidence: 99%

Ransomware Detection Using Stacked Autoencoder for Feature Selection

Wa Nkongolo,

Tokmak

2024

IJEEI

View full text Add to dashboard Cite

In response to the escalating malware threats, we propose an advanced ransomware detection and classification method. Our approach combines a stacked autoencoder for precise feature selection with a Long Short-Term Memory classifier which significantly enhances ransomware stratification accuracy. The process involves thorough preprocessing of the UGRansome dataset, training an unsupervised stacked autoencoder for optimal feature selection, and fine-tuning via supervised learning to elevate the Long Short-Term Memory model's classification capabilities. We meticulously analysed the autoencoder's learned weights and activations to pinpoint essential features for distinguishing 17 ransomware families from other malware and created a streamlined feature set for precise classification. Our results demonstrate the exceptional performance of the stacked autoencoder-based Long Short-Term Memory model across the 17 ransomware families. This model exhibits high precision, recall, and F1 score values. Furthermore, balanced average scores affirm its ability to generalize effectively across various malware types. To optimise the proposed model, we conducted extensive experiments, including up to 400 epochs, and varying learning rates and achieved an exceptional 98.5% accuracy in ransomware classification. These results surpass traditional machine learning classifiers. Moreover, the proposed model surpasses the Extreme Gradient Boosting (XGBoost) algorithm, primarily due to its effective stacked autoencoder feature selection mechanism and demonstrates outstanding performance in identifying signature attacks with a 98.5% accuracy rate. This result outperforms the XGBoost model, which achieved a 95.5% accuracy rate in the same task. In addition, a prediction of the ransomware financial impact using the proposed model reveals that while Locky, SamSam, and WannaCry still incur substantial cumulative costs, their attacks may not be as financially damaging as those of NoobCrypt, DMALocker, and EDA2.

show abstract

A New Framework for Fraud Detection in Bitcoin Transactions Through Ensemble Stacking Model in Smart Cities

Nayyer,

Javaid,

Akbar

et al. 2023

IEEE Access

View full text Add to dashboard Cite

Bitcoin has a reputation of being used for unlawful activities, such as money laundering, dark web transactions, and payments for ransomware in the context of smart cities. Blockchain technology prevents illegal transactions, but cannot detect these transactions. Anomaly detection is a fundamental technique for recognizing potential fraud. The heuristic and signature-based approaches were the foundation of earlier detection techniques, but tragically, these methods were insufficient to explore the entire complexity of anomaly detection. Machine Learning (ML) is a promising approach to anomaly detection, as it can be trained on large datasets of known malware samples to identify patterns and features of the transactions. Researchers are focusing on determining an efficient fraud and security threat detection model that overcomes the drawbacks of the existing methods. Therefore, ensemble learning can be applied to anomaly detection in Bitcoin by combining multiple ML classifiers. In the proposed model, the ADASYN-TL (Adaptive Synthetic + Tomek Link) balancing technique is used for data balancing. Random search, grid search and Bayesian optimization are used for hyperparameter tuning. The hyperparameters have a great impact on the performance of the model. For classification, we used the stacking model by combining Decision Tree, Naive Bayes, K-Nearest Neighbors, and Random Forest. We used SHapley Additive exPlanation (SHAP) to interpret the predictions of the stacking model. The model also explores the performance of different classifiers using accuracy, F1-score, Area Under Curve-Receiver Operating Characteristic (AUC-ROC), precision, recall, False Positive Rate (FPR) and execution time, and ultimately selects the ideal model. The proposed model contributes to the development of effective fraud detection models that address the limitations of the existing algorithms. Our stacking model, which combines the prediction of multiple classifiers, achieved the highest F1-score of 97%, precision of 96%, recall of 98%, accuracy of 97%, AUC-ROC of 99% and FPR of 3%.

show abstract

Machine Learning-Based Ransomware Classification of Bitcoin Transactions

Cited by 10 publications

References 32 publications

RFSA: A Ransomware Feature Selection Algorithm for Multivariate Analysis of Malware Behavior in Cryptocurrency

RFSA: A Ransomware Feature Selection Algorithm for Multivariate Analysis of Malware Behavior in Cryptocurrency

Ransomware Detection Using Stacked Autoencoder for Feature Selection

A New Framework for Fraud Detection in Bitcoin Transactions Through Ensemble Stacking Model in Smart Cities

Contact Info

Product

Resources

About