Ransomware Detection via Cosine Similarity-Based Machine Learning on Bytecode Representations
Michael Argene, Clara Ravenscroft, Ivy Kingswell
Abstract
Ransomware has become one of the most persistent and damaging threats in the digital landscape, causing significant disruptions to organizations and individuals worldwide. The introduction of a novel ransomware detection methodology, which leverages cosine similarity of bytecode combined with advanced machine learning techniques, represents a significant advancement in the fight against this evolving menace. Unlike traditional detection methods that rely on static signatures or behavioral analysis, the proposed approach focuses on the structural characteristics of ransomware, enabling the detection of even the most obfuscated or previously unseen variants. Through rigorous experimentation and performance evaluation, the model demonstrated high accuracy, precision, recall, and F1scores across a diverse set of ransomware variants, validating its effectiveness and robustness. The study highlights the potential of integrating sophisticated similarity metrics with machine learning to create more adaptive and reliable ransomware detection systems, capable of addressing the dynamic and complex nature of modern cyber threats.