Automated Analysis Approach for the Detection of High Survivable Ransomware
Yahye Abukar Ahmed, Barış Koçer, Bander Ali Saleh Al‐rimy · KSII Transactions on Internet and Information Systems · 2020
Ransomware is malicious software that encrypts the user-related files and data and holds them to ransom.Such attacks have become one of the serious threats to cyberspace.The avoidance techniques that ransomware employs such as obfuscation and/or packing makes it difficult to analyze such programs statically.Although many ransomware detection studies have been conducted, they are limited to a small portion of the attack's characteristics.To this end, this paper proposed a framework for the behavioral-based dynamic analysis of high survivable ransomware (HSR) with integrated valuable feature sets.Term Frequency-Inverse document frequency (TF-IDF) was employed to select the most useful features from the analyzed samples.Support Vector Machine (SVM) and Artificial Neural Network (ANN) were utilized to develop and implement a machine learning-based detection model able to recognize certain behavioral traits of high survivable ransomware attacks.Experimental evaluation indicates that the proposed framework achieved an area under the ROC curve of 0.987 and a few false positive rates 0.007.The experimental results indicate that the proposed framework can detect high survivable ransomware in the early stage accurately.