Detecting Ransomware Threats in Disk Storage through Behavioral Analysis using CNN2D and Flask Framework
Bhasha Pydala, Allampati Sireesha, Peese Tejeswara Rao, Supriya Veluru, Ramireddy Sai Charan Reddy, V. Jyothsna · Advances in computer science research · 2024
A novel strategy for combatting ransomware has emerged, aiming to circumvent the limitations of traditional antivirus software which ransomware often evades.Ransomware, by encrypting files and restricting user access to systems and data, poses a significant threat.The proposed solution involves a ransomware detection system operating within virtual machines, which collects data on processor and disk I/O activities from the host machine.Utilizing a machine learning classifier, specifically a 2D Convolutional Neural Network (CNN2D), Voting Classifier and XGBoost.Its approach seeks to minimize overhead by collectively monitoring processes rather than individually, thereby reducing the risk of data corruption induced by ransomware.The system boasts rapid detection, particularly effective against both known and unknown ransomware variants, with the random forest classifier demonstrating superior performance.Moreover, the CNN2D architecture enhances feature extraction, allowing the model to identify relevant patterns for precise classification.By selectively monitoring processor and disk I/O events, the system maintains efficiency while ensuring comprehensive coverage against ransomware activities.Across diverse user loads and ransomware types, the system consistently achieves high detection rates.Detection outcomes are conveniently presented using the Flask Framework.