Data-Centric Machine Learning Approach for Early Ransomware Detection and Attribution

Aldin Vehabovic, Hadi Zanddizari, Nasir Ghani, F. Shaikh, Elias Bou‐Harb, Morteza Safaei Pour, Jorge Crichigno

202323 citationsDOI

Abstract

Researchers have proposed a wide range of ransomware detection and analysis schemes. However, most of these efforts have focused on older families targeting Windows 7/8 systems. Hence there is a critical need to develop efficient solutions to tackle the latest threats, many of which may have relatively fewer samples to analyze. This paper presents a machine learning (ML) framework for early ransomware detection and attribution. The solution pursues a data-centric approach which uses a minimalist ransomware dataset and implements static analysis using portable executable (PE) files. Results for several ML classifiers confirm strong performance in terms of accuracy and zero-day threat detection.

Topics & Concepts

RansomwareComputer scienceExecutableMalwareMachine learningAttributionArtificial intelligenceStatic analysisData miningComputer securityOperating systemProgramming languagePsychologySocial psychologyAdvanced Malware Detection TechniquesNetwork Security and Intrusion DetectionDigital and Cyber Forensics